CVE-2025-2110

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2110", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-07T21:55:58.098Z", "datePublished": "2025-03-26T11:22:08.756Z", "dateUpdated": "2026-04-08T16:43:43.207Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:43.207Z"}, "affected": [{"vendor": "aresit", "product": "WP Compress \u2013 Instant Performance & Speed Optimization", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.30.15", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Compress \u2013 Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin\u2019s functionality, and potentially impacting overall site performance."}], "title": "WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php"}, {"url": "https://wordpress.org/plugins/wp-compress-image-optimizer/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3254259/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-03-25T21:29:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-26T13:37:24.990900Z", "id": "CVE-2025-2110", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T13:39:51.095Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-26T13:37:24.990900Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T13:37:31.871Z"}}], "cna": {"title": "WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "aresit", "product": "WP Compress \u2013 Instant Performance & Speed Optimization", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.30.15"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-25T21:29:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php"}, {"url": "https://wordpress.org/plugins/wp-compress-image-optimizer/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3254259/"}], "descriptions": [{"lang": "en", "value": "The WP Compress \u2013 Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin\u2019s functionality, and potentially impacting overall site performance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:43.207Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2110", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:43.207Z", "dateReserved": "2025-03-07T21:55:58.098Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-26T11:22:08.756Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Compress \u2013 Instant Performance & Speed Optimization", "vendor": "aresit", "versions": [{"lessThanOrEqual": "6.30.15", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpcompress:wp_compress:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "07F29DE0-6E67-4BE3-96B2-DCAF51C9C755", "versionEndExcluding": "6.30.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Compress \u2013 Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin\u2019s functionality, and potentially impacting overall site performance."}, {"lang": "es", "value": "El complemento WP Compress \u2013 Instant Performance &amp; Speed Optimization para WordPress es vulnerable al acceso no autorizado, la modificaci\u00f3n y la p\u00e9rdida de datos debido a la falta de comprobaciones de capacidad en sus funciones AJAX en todas las versiones hasta la 6.30.15 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, comprometan el sitio de diversas maneras seg\u00fan la funci\u00f3n espec\u00edfica explotada; por ejemplo, recuperando ajustes y detalles de configuraci\u00f3n confidenciales, o modific\u00e1ndolos y elimin\u00e1ndolos, revelando as\u00ed informaci\u00f3n confidencial, interrumpiendo la funcionalidad del complemento y potencialmente afectando al rendimiento general del sitio."}], "id": "CVE-2025-2110", "lastModified": "2026-06-17T09:06:20.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2110", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-26T13:37:24.990900Z", "version": "2.0.3"}}]}, "published": "2025-03-26T12:15:15.827", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/changeset/3254259/"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://wordpress.org/plugins/wp-compress-image-optimizer/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T03:28:11.767684+00:00", "value": {"mitigation_remediation": ["Upgrade WP Compress to version 6.30.16 or later, where the missing authorization checks have been corrected.", "If an upgrade cannot be applied immediately, block or disable the relevant AJAX URLs for Subscriber and higher roles using a web\u2011server or firewall rule, or temporarily deactivate the plugin until the patch is applied.", "Audit and tighten user roles so that only trusted administrators have access to the plugin\u2019s AJAX endpoints, and review plugin settings to ensure sensitive configuration options are not exposed via AJAX."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Data Access and Modification"}, "threat_synthesis": {"affected_systems": "All installations of the aresit WP Compress \u2013 Instant Performance & Speed Optimization plugin, in versions 6.30.15 and earlier, on WordPress sites are affected. No specific WordPress core version is mentioned, so any site running the vulnerable plugin regardless of core version is susceptible.", "description_and_impact": "The WordPress plugin WP Compress has missing capability checks on its AJAX functions in all versions up to and including 6.30.15. Authenticated users with Subscriber level or higher can call these endpoints without proper authorization, allowing them to retrieve, change, or delete plugin configuration and settings. This can expose sensitive information, disrupt the plugin\u2019s operation, degrade site performance, and compromise overall site integrity. The weakness is a missing authorization check, identified as CWE-862.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.8, marking it as high severity. EPSS indicates an exploitation probability of less than 1%, suggesting that real\u2011world attacks have been scarce so far, yet the requirement of only Subscriber\u2011level authentication makes it an attractive target. The attack vector is through the web, exploiting AJAX endpoints accessible over HTTP; no elevation of privileges or local code execution is needed. The flaw is not currently listed in the CISA KEV catalog, but the missing authorization remains a serious risk for future exploitation."}}}}, "created": "2026-04-28T03:30:19.832967+00:00", "updated": "2026-04-28T03:30:19.832978+00:00", "vendors": []}