8.8

CVE-2025-2110

WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions

WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
Mögliche Gegenmaßnahme
WP Compress – Instant Performance & Speed Optimization: Update to version 6.30.16, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpcompress ≫ Wp Compress SwPlatformwordpress Version < 6.30.16
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WP Compress – Instant Performance & Speed Optimization
Version *-6.30.15
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.313
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://wordpress.org/plugins/wp-compress-image-optimizer/#developers
Release Notes
https://plugins.trac.wordpress.org/changeset/3254259/
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=cve
Third Party Advisory
https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06
Third Party Advisory