CVE-2023-6699: WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6699?
CVE-2023-6699 has a medium severity rating, as it allows unauthenticated attackers to access arbitrary files on the server.
How do I fix CVE-2023-6699?
To fix CVE-2023-6699, update the WP Compress – Image Optimizer plugin to the latest version above 6.10.33.
Who is affected by CVE-2023-6699?
CVE-2023-6699 affects all versions of the WP Compress – Image Optimizer plugin for WordPress up to and including version 6.10.33.
What kind of attacks can exploit CVE-2023-6699?
CVE-2023-6699 can be exploited to perform directory traversal attacks, potentially exposing sensitive files on the server.
Is authentication required to exploit CVE-2023-6699?
No, authentication is not required to exploit CVE-2023-6699, making it particularly dangerous for vulnerable installations.