The WP Compress plugin for WordPress is vulnerable to an unauthenticated settings change, which could allow an attacker to alter plugin configurations and disrupt service.

This vulnerability is caused by a missing authorization check (CWE-862) within the plugin, which allows an unauthenticated attacker to change sensitive plugin settings via the web interface.

Successful exploitation of this flaw allows an unauthenticated attacker to modify plugin configuration without prior access, which may lead to service disruption or the unauthorized modification of image optimization behaviors. With a CVSS score of 8.2, this vulnerability represents a high risk that could be leveraged to impact site integrity and availability.

Immediate Action: Update the WP Compress plugin to version 7.22.0 or later to ensure the authorization check is properly enforced.

Proactive Monitoring: Review web access logs for unauthorized POST requests directed at plugin settings endpoints and monitor for unexpected changes in plugin configuration.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests to the plugin's administrative settings path until the update is applied.

Public Exploit Available: No.

Given the high severity of this vulnerability and the lack of required authentication, it is imperative that administrators update the WP Compress plugin immediately. Failure to apply the provided patch leaves the application exposed to unauthorized configuration changes that could negatively impact the site's operational integrity.