CVE-2025-2110

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php	Product
https://plugins.trac.wordpress.org/changeset/3254259/	Product
https://wordpress.org/plugins/wp-compress-image-optimizer/#developers	Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wpcompress:wp_compress:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2025-03-26 12:15

Updated : 2025-08-11 18:02

NVD link : CVE-2025-2110

Mitre link : CVE-2025-2110

CVE.ORG link : CVE-2025-2110

JSON object : View

Products Affected

wpcompress

wp_compress

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-2110", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-03-26T12:15:15.827", "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3254259/", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/wp-compress-image-optimizer/#developers", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=cve", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The WP Compress \u2013 Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin\u2019s functionality, and potentially impacting overall site performance."}, {"lang": "es", "value": "El complemento WP Compress \u2013 Instant Performance & Speed Optimization para WordPress es vulnerable al acceso no autorizado, la modificaci\u00f3n y la p\u00e9rdida de datos debido a la falta de comprobaciones de capacidad en sus funciones AJAX en todas las versiones hasta la 6.30.15 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, comprometan el sitio de diversas maneras seg\u00fan la funci\u00f3n espec\u00edfica explotada; por ejemplo, recuperando ajustes y detalles de configuraci\u00f3n confidenciales, o modific\u00e1ndolos y elimin\u00e1ndolos, revelando as\u00ed informaci\u00f3n confidencial, interrumpiendo la funcionalidad del complemento y potencialmente afectando al rendimiento general del sitio."}], "lastModified": "2025-08-11T18:02:44.917", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpcompress:wp_compress:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "07F29DE0-6E67-4BE3-96B2-DCAF51C9C755", "versionEndExcluding": "6.30.16"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}