Vulnerabilidades de AresIT
CVEs publicadas que afetam produtos de AresIT: 4 registro(s), com severidade, exploração e correções.
CVE-2026-84757
Alta · 8.2
CWE-862 03/09/2026
WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
CVE-2026-73343
Crítica · 10.0
CWE-94 18/08/2026
WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-17608
Média · 6.5
CWE-352 16/08/2026
WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2026-25370
Média · 5.3
CWE-862 19/02/2026
WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.