The WP Compress – Instant Performance & Speed Optimization plugin contains a cross‑site request forgery flaw that arises from missing or incorrect nonce validation in a core function. Because the plugin accepts requests without validating a user’s intent, an attacker can craft a forged request that, when executed by an authenticated administrator, deletes arbitrary WordPress options. Critical options such as siteurl, home, active_plugins, template, and stylesheet can be removed, causing the site to become inaccessible or resetting plugins and themes.

This vulnerability affects installations of WP Compress version 7.10.09 and earlier on any WordPress site that has the plugin installed. The affected code resides in the menu.class.php file of the plugin. An administrator who entrusts the site to a malicious link can trigger the exploit. Any WordPress installation running a vulnerable version of the plugin is at risk.

The CVSS base score of 6.5 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently exploited in widely known attacks. The attack requires the target admin to be tricked into visiting a forged URL; no authentication is needed for the attacker. Once the forged request is executed, the attacker can delete configuration options and cause service disruption. The overall risk is considered moderate but high if an administrator is susceptible to phishing or social engineering.