CVE-2025-2109: WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP Compress – Instant Performance & Speed Optimizationto a version that resolves this vulnerability.Fixed in 6.30.15Patch WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function - Compensating control
Restrict outbound network access from the WordPress server/plugin environment to prevent SSRF-based access to internal services.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2109?
CVE-2025-2109 is classified as a high-severity vulnerability due to its potential for exploitation via Server-Side Request Forgery.
How do I fix CVE-2025-2109?
To remediate CVE-2025-2109, update the WP Compress – Instant Performance & Speed Optimization plugin to version 6.30.16 or later.
Who is affected by CVE-2025-2109?
CVE-2025-2109 affects all versions of the WP Compress – Instant Performance & Speed Optimization plugin up to and including 6.30.15.
What type of vulnerability is CVE-2025-2109?
CVE-2025-2109 is a Server-Side Request Forgery vulnerability that allows attackers to send requests to untrusted domains.
Can CVE-2025-2109 be exploited without authentication?
Yes, CVE-2025-2109 can be exploited by unauthenticated attackers, making it particularly concerning.