CVE-2026-17608
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress up to version 7.10.09 is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation. Unauthenticated attackers can trick an administrator into performing an action that deletes arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset.
Risk Assessment
An attacker can cause a complete site outage or loss of configuration, potentially requiring costly recovery and exposing the organization to downtime.
Recommendation
Update the WP Compress plugin to the latest version if a patch is available. Additionally, educate administrators about CSRF threats and consider implementing additional protections such as sameSite cookies.
Original NVD description (English source)
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.