AresIT vulnerabilities
Published CVEs affecting AresIT products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-84757
High · 8.2
CWE-862 Sep 3, 2026
WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
CVE-2026-73343
Critical · 10.0
CWE-94 Aug 18, 2026
WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-17608
Medium · 6.5
CWE-352 Aug 16, 2026
WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2026-25370
Medium · 5.3
CWE-862 Feb 19, 2026
WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.