Blog An unauthenticated RCE in WP Compress, patched in 7.20.01
An unauthenticated RCE in WP Compress, patched in 7.20.01
WP Compress ships version 7.20.01 to close a maximum-severity RCE that needs no login. Four other WordPress plugins carry critical bugs the same day, with two PHP object injections, one SQL injection, and one subscriber-level takeover.
The worst bug of the day is a straight remote code execution in WP Compress. No login. No user role. CVSS 10. That is the whole score, and it is rare. If the plugin runs on your site and you are not on 7.20.01, treat it as urgent.
The rest of the day fits one pattern. Every critical bug on the list is reachable without an account. Two are PHP object injection. One is SQL injection. One is subscriber-level privilege escalation. Four out of five plugins are attacked by any visitor who finds the site.
wp-compress-image-optimizer 7.20.01
An unauthenticated attacker can run PHP code on the server. The plugin has around 10,000 active installs. The current directory version is 7.21.28, well past the fix.
- Affected: versions before 7.20.01
- CVE: CVE-2026-73343, CVSS 10
- Patched in: 7.20.01
- Action: update to 7.21.28 today. After update, review
wp-content/uploadsfor stray PHP files and check the site for unknown admin users.
custom-registration-form-builder-with-submission-manager up to 6.0.9.7
RegistrationMagic accepts an untrusted serialized payload from an unauthenticated request. PHP object injection turns that into whatever a gadget chain in the site’s code can reach. On a WordPress install with many plugins, that reach is often full.
- Affected: versions 6.0.9.7 and earlier
- CVE: CVE-2026-73341, CVSS 9.8
- Action: update to 6.0.9.8, the current directory release.
sticky-chat-widget up to 1.4.2
An unauthenticated SQL injection. An attacker sends a crafted request and reads or changes rows in the site database. That includes the users table and its password hashes.
- Affected: versions 1.4.2 and earlier
- CVE: CVE-2026-73187, CVSS 9.3
- Action: update to 1.4.3. After update, force a password reset for every user and rotate any secrets stored in the database.
fundengine up to 1.7.9, unpatched
The same class as RegistrationMagic: PHP object injection from an unauthenticated request. The record names no fixed release. Owners of a site running FundEngine should check with the vendor before waiting.
- Affected: versions 1.7.9 and earlier
- CVE: CVE-2026-32470, CVSS 9.8
- Action: no confirmed fix at time of writing. Disable the plugin until the vendor ships an update.
the-grid up to 2.7.9.1, unpatched
A subscriber can escalate privileges. The bug needs a login, so it is less severe than the four above, but WordPress sites that allow open registration hand out subscriber accounts to anyone. On those sites the difference is small.
- Affected: versions 2.7.9.1 and earlier
- CVE: CVE-2026-28191, CVSS 8.8
- Auth: subscriber
- Action: no confirmed fix at time of writing. If the site allows open user registration, disable it or disable the plugin.
Four of the five bugs above run with no login. That is the threat model a site scanner needs to catch, because the attacker never logs in and never trips an audit log. For sites that want a WordPress malware scanner and cleanup tool built for exactly this kind of plugin compromise, Segurium is available on the official directory at wordpress.org/plugins/segurium/.
Share this post
Tags: #wordpress , #plugin , #cve , #exploit