CVE-2025-2109: WP Compress Plugin SSRF Vulnerability

CVE-2025-2109 Overview

CVE-2025-2109 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Compress – Instant Performance & Speed Optimization plugin for WordPress. The flaw affects all versions up to and including 6.30.15 and resides in the plugin's init() function. Unauthenticated attackers can coerce the WordPress server into issuing HTTP requests to arbitrary destinations, including internal-only services that are not directly reachable from the internet. The vulnerability is tracked under CWE-918: Server-Side Request Forgery and was published to the National Vulnerability Database on March 25, 2025.

Critical Impact
Unauthenticated attackers can pivot through vulnerable WordPress sites to probe internal network services, cloud metadata endpoints, and other resources normally shielded from external access.

Affected Products

WP Compress – Instant Performance & Speed Optimization plugin for WordPress
All plugin versions up to and including 6.30.15
WordPress installations with the wp-compress-image-optimizer plugin enabled

Discovery Timeline

2025-03-25 - CVE-2025-2109 published to NVD with details sourced from a Wordfence vulnerability report
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2109

Vulnerability Analysis

The vulnerability exists in the init() function of wp-compress-core.php in the WP Compress plugin. The function accepts a user-controllable URL parameter and passes it to a server-side HTTP request routine without sufficient validation of the target host. Because the request originates from the WordPress server, it inherits the server's network position and can reach hosts that external clients cannot. The source implementation is visible in the plugin source at line 994.

The scope is marked as Changed in the CVSS vector, reflecting that the vulnerable component (the WordPress plugin) can influence resources beyond its own security authority — namely internal services on the hosting infrastructure. Confidentiality impact is limited to information returned in HTTP responses, but this is often enough to enumerate internal services, retrieve cloud instance metadata, or map internal networks.

Root Cause

The root cause is missing or insufficient allow-list validation of the destination URL supplied to the init() function. The plugin does not restrict requests to a set of trusted hosts, does not filter private, loopback, or link-local IP ranges, and does not resolve hostnames prior to validation. Any unauthenticated user reaching the endpoint can therefore control the destination of an outbound HTTP request issued by the plugin.

Attack Vector

Exploitation requires only network access to the target WordPress site — no authentication and no user interaction. An attacker crafts an HTTP request that reaches the vulnerable init() handler with a target URL pointing to an internal resource. Typical SSRF targets include cloud metadata services on 169.254.169.254, internal admin panels on RFC1918 addresses, database services bound to localhost, and Kubernetes API endpoints. The plugin then returns response content or side-channel signals (timing, size, status codes) that the attacker can use to enumerate the internal environment.

Since no verified public exploit code is available, refer to the Wordfence advisory and the upstream changeset for the technical fix details.

Detection Methods for CVE-2025-2109

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP worker process to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 169.254.169.254
Web server access logs showing unauthenticated requests to WP Compress plugin endpoints with URL-like parameters pointing to non-standard hosts
DNS queries from the web server resolving unexpected external domains supplied by remote users
Unusual response sizes or timing patterns in WP Compress plugin responses that correlate with internal service probing

Detection Strategies

Inspect WordPress request logs for calls to WP Compress plugin URLs containing user-supplied URL, host, or endpoint parameters
Correlate PHP outbound connections with the originating HTTP request to identify SSRF chains
Deploy Web Application Firewall rules that block plugin requests targeting private IP space, loopback, and cloud metadata addresses

Monitoring Recommendations

Alert on any egress traffic from web server hosts to 169.254.169.254 or other cloud metadata endpoints
Monitor for spikes in outbound requests from PHP processes tied to the WP Compress plugin
Track plugin version inventory across WordPress fleets and flag installations at or below version 6.30.15

How to Mitigate CVE-2025-2109

Immediate Actions Required

Update the WP Compress – Instant Performance & Speed Optimization plugin to a version above 6.30.15 across all WordPress installations
Restrict outbound network access from WordPress servers using egress firewall rules that deny private and metadata IP ranges by default
Audit web server and application logs for prior SSRF attempts against WP Compress endpoints

Patch Information

The vendor addressed the SSRF via changeset 3254259 in the plugin's Subversion repository. Administrators should apply the fixed version through the WordPress plugin updater or by downloading it from the official plugin page. Confirm the installed version is above 6.30.15 after updating.

Workarounds

Disable or uninstall the WP Compress plugin until it can be updated to a patched version
Place the WordPress instance behind a WAF configured to block outbound URLs targeting internal address space
On cloud hosts, enforce Instance Metadata Service Version 2 (IMDSv2) to require session tokens and reduce SSRF impact against metadata endpoints
Apply network segmentation so the WordPress host cannot reach sensitive internal services directly