CVE-2025-2109CWE-918

WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function

Medium · published March 25, 2025

CVSS v3.1
5.8
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-03-25T11:12Z
EPSS history
Timeline
  • 25 MAR 11:12Z
    WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function
    cvelistv5