CVE-2025-57899
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The WP Compress plugin (wp-compress-image-optimizer) for WordPress has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This affects versions up to 6.50.54.
Risk Assessment
Unauthorized users may gain access to protected functionality, potentially leading to unauthorized changes in configuration or data. This can compromise system integrity and confidentiality.
Recommendation
Update the WP Compress plugin to the latest version that includes a fix. If not available, restrict access to plugin functionality using appropriate rules.
Other vulnerabilities in WP Compress
See all- CVE-2026-73343Critical
An unauthenticated attacker can remotely execute arbitrary code (RCE) in WP Compress versions prior to 7.20.01.
- CVE-2026-84757High
Unauthenticated Settings Change in WP Compress versions up to 7.21.28. An attacker can change plugin configuration without authentication.
- CVE-2026-17608Medium
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress up to version 7.10.09 is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation. Unauthenticated attackers can trick an administrator into performing an action that deletes arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset.
- CVE-2026-9066Medium
The WP Compress WordPress plugin before version 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build URLs of JavaScript files, leading to Reflected XSS. When a visitor follows a crafted link, the plugin's loader injects script elements pointing to an attacker-controlled origin, allowing arbitrary JavaScript execution in the visitor's session on the target site.
Original NVD description (English source)
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Compress: from n/a through <= 6.50.54.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS