Answer in brief
CVE-2026-17608 records a Unknown severity vulnerability in WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion. The current sources do not mark it as known exploited. The current feed maps aresit/WP Compress – Instant Performance & Speed Optimization (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-17608 records a Unknown severity vulnerability in WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion. The current sources do not mark it as known exploited. The current feed maps aresit/WP Compress – Instant Performance & Speed Optimization (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps aresit/WP Compress – Instant Performance & Speed Optimization (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| aresit/WP Compress – Instant Performance & Speed Optimizationgeneric | 0 | Not reported |
Published upstream
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 16, 2026
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps aresit/WP Compress – Instant Performance & Speed Optimization (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| aresit/WP Compress – Instant Performance & Speed Optimizationgeneric | 0 | Not reported |
Published upstream
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 16, 2026
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Quoted source text, attributed separately from HOL analysis.