CVE-2025-2110: WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-compress-instant-performance-speed-optimizationto a version that resolves this vulnerability.Fixed in 6.30.15 - Configuration
Update the plugin so every AJAX handler performs proper authorization/capability checks (the vulnerability is described as missing capability checks on its AJAX functions).
WP Compress – Instant Performance & Speed Optimization AJAX capability checks on plugin AJAX functions = Ensure Subscriber+ cannot access functions unless required capability checks are implemented
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2110?
CVE-2025-2110 has a high severity level due to the potential for unauthorized access and data loss.
How do I fix CVE-2025-2110?
To fix CVE-2025-2110, update the WP Compress – Instant Performance & Speed Optimization plugin to version 6.30.16 or later.
What causes CVE-2025-2110?
CVE-2025-2110 is caused by missing capability checks on AJAX functions in the affected plugin versions.
Who is affected by CVE-2025-2110?
All users of the WP Compress – Instant Performance & Speed Optimization plugin up to and including version 6.30.15 are affected by CVE-2025-2110.
What can attackers do with CVE-2025-2110?
Attackers can exploit CVE-2025-2110 to gain unauthorized access, modify content, and potentially corrupt or delete data.