CVE-2026-73343 Overview
CVE-2026-73343 is an unauthenticated remote code execution vulnerability in the WP Compress Image Optimizer WordPress plugin, affecting versions prior to 7.20.01. The flaw is classified under CWE-94: Improper Control of Generation of Code, commonly known as code injection. An unauthenticated attacker can reach the vulnerable code path over the network and execute arbitrary code on the underlying server. The vulnerability received a maximum CVSS 3.1 base score, reflecting network exploitability, no privileges required, no user interaction, and a scope change that impacts confidentiality, integrity, and availability.
Critical Impact
Unauthenticated attackers can execute arbitrary code on WordPress sites running WP Compress prior to 7.20.01, leading to full site compromise.
Affected Products
- WP Compress Image Optimizer plugin for WordPress, all versions before 7.20.01
- WordPress sites with the vulnerable plugin activated
- Hosting environments running the affected plugin in shared PHP contexts
Discovery Timeline
- 2026-08-18 - CVE-2026-73343 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-73343
Vulnerability Analysis
CVE-2026-73343 is a code injection vulnerability [CWE-94] in the WP Compress Image Optimizer plugin. The plugin fails to properly control the generation of code from externally influenced input, allowing an attacker to inject and execute code within the WordPress runtime.
Exploitation requires no authentication and no user interaction. An attacker sends a crafted HTTP request to the vulnerable endpoint exposed by the plugin, and the server processes attacker-controlled input as executable code. Successful exploitation results in arbitrary code execution under the PHP process running WordPress.
Because WordPress plugins typically execute with the privileges of the web server user, an attacker can read and modify site content, exfiltrate database contents including credentials, plant persistent backdoors, and pivot to other resources reachable from the host.
Root Cause
The root cause is improper handling of untrusted input that is subsequently interpreted as code. Typical patterns behind [CWE-94] in WordPress plugins include unsafe use of eval(), call_user_func() with attacker-controlled callable names, create_function(), dynamic include/require on unsanitized paths, or deserialization of attacker-supplied payloads. The vendor advisory published on Patchstack documents the affected code paths and the fix in version 7.20.01.
Attack Vector
The attack vector is network-based. An unauthenticated remote attacker sends a specially crafted HTTP request to a publicly reachable plugin endpoint on a vulnerable WordPress site. The vulnerable handler processes the payload without sufficient validation and evaluates attacker-controlled data as code. The scope-change designation in the CVSS vector indicates that impact can extend beyond the vulnerable component to the wider WordPress installation and adjacent resources.
Refer to the Patchstack WordPress Vulnerability Report for the confirmed technical description and remediation details.
Detection Methods for CVE-2026-73343
Indicators of Compromise
- Unexpected PHP files or webshells written under wp-content/plugins/wp-compress-image-optimizer/ or wp-content/uploads/
- Outbound network connections from the web server process to unknown hosts following requests to WP Compress endpoints
- New or modified WordPress administrator accounts and unexpected changes to wp-config.php or .htaccess
- Anomalous POST requests to WP Compress AJAX or REST endpoints from unauthenticated sources
Detection Strategies
- Inventory WordPress installations and identify sites running WP Compress Image Optimizer versions earlier than 7.20.01
- Inspect web server access logs for POST requests to plugin endpoints containing serialized payloads or PHP function names
- Correlate web-tier requests with subsequent process executions such as sh, bash, python, or curl spawned by the PHP handler
Monitoring Recommendations
- Enable file integrity monitoring on the wp-content/plugins/ and wp-content/uploads/ directories
- Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for retention and correlation
- Alert on child processes spawned by php-fpm or httpd that are inconsistent with normal WordPress behavior
How to Mitigate CVE-2026-73343
Immediate Actions Required
- Update WP Compress Image Optimizer to version 7.20.01 or later on every affected WordPress site
- If immediate patching is not feasible, deactivate and remove the WP Compress plugin until the update is applied
- Rotate WordPress administrator passwords, API keys, and database credentials on any site suspected to be exploited
- Review installed plugins, themes, and user accounts for unauthorized modifications
Patch Information
The vendor has released WP Compress Image Optimizer version 7.20.01, which remediates CVE-2026-73343. Site administrators should apply the update through the WordPress plugin manager or by deploying the patched release from the vendor. See the Patchstack WordPress Vulnerability Report for the confirmed fixed version.
Workarounds
- Block external access to WP Compress plugin endpoints at the web application firewall or reverse proxy until the patch is applied
- Restrict WordPress admin and plugin routes to trusted IP ranges using web server access controls
- Enforce least privilege for the PHP process user and disable dangerous PHP functions such as eval, exec, system, and passthru in php.ini where the application permits
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
