CVE-2026-25370: 
WordPress vulnerability analysis and mitigation

CVE-2026-25370 is a Missing Authorization (Broken Access Control) vulnerability in the AresIT WP Compress image optimizer WordPress plugin. It affects all versions of the plugin up to and including 6.60.28, allowing unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions or exposing data. Because no authentication or capability checks are enforced on the affected endpoints, any unauthenticated network-accessible attacker can trigger restricted functionality. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit (Feedly).

Successful exploitation results in unauthorized read access to sensitive information exposed by the plugin, with a low confidentiality impact and no direct integrity or availability impact. An attacker could access data or functionality that should be restricted to authorized users (e.g., administrators), potentially revealing configuration details or internal plugin state. While the immediate impact is limited, exposed information could facilitate further attacks against the WordPress installation or its underlying infrastructure (Feedly).

The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it accessible to a wide range of attackers. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of active exploitation in the wild. No public proof-of-concept exploit code, exploit kit integration, threat actor attribution, or CISA KEV catalog listing has been identified at this time (Feedly).

Users should update the WP Compress plugin to a version beyond 6.60.28 that includes a fix for this access control issue. Until a patched version is available or applied, administrators should consider deactivating the plugin or restricting access to the WordPress site via network-level controls (e.g., IP allowlisting for the admin panel). Monitoring WordPress access logs for unexpected requests to plugin-specific endpoints is also advisable (Patchstack).