The WP Compress – Instant Performance & Speed Optimization plugin allows an unauthenticated attacker to overload the unevaluated `group`, `setting`, and `value` parameters fed to the internal `change_setting()` routine. Because the dispatcher `start_comms` only compares a supplied apikey against the stored API key, it omits any WordPress capability check or nonce verification. The direct writing of the supplied parameters into the `WPS_IC_SETTINGS` option expands the plugin’s capabilities, and in turn the user‑role checker grants the `manage_wpc_settings` right to any role, including Subscriber. In practice, this means the attacker can change the optimization, CDN, and critical‑CSS behaviour as if holding full plugin‑administration authority. The vulnerability therefore undermines the integrity and configuration safety of WordPress sites that rely on a correct partitioning of roles.

Any WordPress installation running Aresit’s WP Compress plugin version 7.25.00 or earlier is affected. The plugin appears under the vendor name Aresit and the product name WP Compress – Instant Performance & Speed Optimization. No other WordPress components are impacted.

The CVSS score of 4.8 places the vulnerability in the moderate range, and the EPSS score is not available. It is not listed in the CISA KEV catalog, indicating that no large‑scale public exploitation has been formally documented. Nonetheless, the exploit chain can be executed entirely from non‑authenticated HTTP requests, as the attacker first obtains the required API key via the publicly callable `wpc_send_critical_remote` AJAX action and then calls `start_comms` with arbitrary parameters. The lack of authentication on a front‑end endpoint and the absence of a nonce make the attack straightforward for automated tools.