Unauthenticated RCE in WP Compress image optimizer plugin (CVE-2026-73343)
Patchstack reported in-the-wild exploitation and VulnCheck added the flaw to its known-exploited catalog on 2026-08-18, so any site still on a pre-7.20.01 build this week is an easy full-takeover target.
WP Compress versions before 7.20.01 contain an unauthenticated remote code execution flaw (CVSS 10.0) that lets any remote attacker run arbitrary code on the WordPress host with no credentials or user interaction. Successful exploitation yields full site compromise, including database access and the ability to plant persistent webshells.
Affected: AresIT WP Compress < 7.20.01 (fixed in 7.20.01)
How to Test
Check the WP Compress version in the wp-admin Plugins page — anything below 7.20.01 is vulnerable. Hunt for compromise: search wp-content (especially uploads and the plugin directory) for recently created PHP files, review web server logs for unauthenticated requests to wp-compress-image-optimizer endpoints, and audit wp_users for newly added administrator accounts.
How to Patch
Update WP Compress to 7.20.01 or later immediately, or deactivate/remove the plugin until you can. Patchstack subscribers can enable the vPatch mitigation; regardless, rotate WordPress salts and admin credentials if you find any indicator of prior exploitation.