CVE-2026-25370: WP Compress Authorization Bypass Flaw

CVE-2026-25370 Overview

CVE-2026-25370 is a Missing Authorization vulnerability discovered in the AresIT WP Compress (wp-compress-image-optimizer) WordPress plugin. This security flaw allows attackers to exploit incorrectly configured access control security levels, potentially gaining unauthorized access to plugin functionality that should be restricted to authenticated administrators.

The vulnerability stems from broken access control mechanisms within the plugin, classified under CWE-862 (Missing Authorization). Without proper authorization checks, unauthenticated or low-privileged users may be able to invoke sensitive plugin operations.

Critical Impact

Unauthorized users may bypass access controls to execute privileged plugin functions, potentially leading to site manipulation, data exposure, or further exploitation of the WordPress installation.

Affected Products

• WP Compress (wp-compress-image-optimizer) versions through 6.60.28

Discovery Timeline

• 2026-02-19 - CVE-2026-25370 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25370

Vulnerability Analysis

This Missing Authorization vulnerability (CWE-862) occurs when the WP Compress plugin fails to verify that users have the appropriate permissions before executing certain actions. In WordPress plugins, proper authorization typically requires checking user capabilities using functions like current_user_can() before performing privileged operations.

When these checks are absent or improperly implemented, attackers can directly invoke AJAX handlers, REST API endpoints, or other plugin functions without having the necessary privileges. This type of broken access control vulnerability is particularly dangerous in WordPress environments where plugins often manage sensitive site operations.

Root Cause

The root cause is the absence of proper authorization verification within the WP Compress plugin's access control implementation. The plugin does not adequately verify user permissions before allowing access to certain functionality, allowing exploitation of incorrectly configured access control security levels. This represents a fundamental failure to implement the principle of least privilege.

Attack Vector

The attack vector for this vulnerability involves an attacker sending crafted requests to the vulnerable plugin endpoints without proper authentication or with insufficient privileges. Since the plugin lacks adequate authorization checks, these requests are processed as if they originated from a privileged user.

Attackers could potentially:

• Access administrative plugin functions without authentication
• Modify plugin settings or configurations
• Trigger image optimization operations without authorization
• Access or manipulate data processed by the plugin

The vulnerability mechanism involves direct requests to plugin endpoints that lack proper capability checks. For detailed technical analysis, refer to the Patchstack Vulnerability Analysis.

Detection Methods for CVE-2026-25370

Indicators of Compromise

• Unexpected or unauthorized changes to WP Compress plugin settings
• Unusual AJAX or REST API requests to WP Compress endpoints from unauthenticated sources
• Access logs showing repeated requests to plugin-specific endpoints without corresponding admin panel activity
• Unauthorized image optimization or processing activities

Detection Strategies

• Monitor WordPress access logs for requests to /wp-admin/admin-ajax.php with WP Compress-specific action parameters from unauthorized IP addresses
• Implement Web Application Firewall (WAF) rules to detect and block suspicious requests targeting the WP Compress plugin
• Review plugin activity logs for operations performed without corresponding admin authentication events
• Deploy WordPress security plugins that monitor for broken access control exploitation attempts

Monitoring Recommendations

• Enable detailed logging for all WordPress AJAX and REST API requests
• Set up alerts for plugin setting changes that occur outside of normal administrative sessions
• Monitor for bulk or automated requests targeting WP Compress endpoints
• Regularly audit WordPress user activity and access patterns

How to Mitigate CVE-2026-25370

Immediate Actions Required

• Update the WP Compress (wp-compress-image-optimizer) plugin to a version higher than 6.60.28 when a patched version becomes available
• Temporarily disable the WP Compress plugin if it is not critical to site operations until a patch is released
• Implement additional access controls at the web server or WAF level to restrict access to plugin endpoints
• Review WordPress access logs for any signs of exploitation

Patch Information

A patched version addressing this vulnerability should be obtained from the official WordPress plugin repository or directly from AresIT. Monitor the Patchstack vulnerability database for updates on remediation status.

Administrators should update to a version higher than 6.60.28 once a security fix is released.

Workarounds

• Disable the WP Compress plugin temporarily until a patched version is available
• Implement IP-based access restrictions to WordPress admin functionality using .htaccess or server configuration
• Deploy a Web Application Firewall (WAF) with rules to protect against broken access control attacks
• Restrict access to admin-ajax.php for unauthenticated users where feasible

# Example .htaccess restriction for wp-admin access (Apache)
<Files admin-ajax.php>
    <RequireAll>
        Require all granted
        # Add IP restrictions as needed
        # Require ip 192.168.1.0/24
    </RequireAll>
</Files>