The missing capability check in the nitropack_set_compression_ajax() function allows an authenticated user with Subscriber or higher privileges to alter the nitropack-enableCompression option. This unauthorized modification changes the compression behaviour of the NitroPack plugin, potentially affecting site performance and data handling but not directly exposing code execution or data exfiltration.

NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization, WordPress plugin; all released versions up to and including 1.18.4 are affected.

The CVSS score of 4.3 classifies this as low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires an authenticated account, an attacker must first compromise a Subscriber or higher‑ranked user to modify the compression setting. No additional attack surface such as remote code execution is disclosed by the CVE data.