CVE-2025-2110: WP Compress Auth Bypass Vulnerability

CVE-2025-2110 Overview

CVE-2025-2110 affects the WP Compress – Instant Performance & Speed Optimization plugin for WordPress in all versions up to and including 6.30.15. The plugin exposes multiple AJAX endpoints in classes/ajax.class.php without capability checks. Authenticated users with Subscriber-level access or above can invoke these endpoints to read, modify, or delete plugin settings. The flaw is tracked as a Missing Authorization weakness [CWE-862] and impacts confidentiality, integrity, and availability of affected sites.

Critical Impact
Any authenticated user with Subscriber privileges can disclose sensitive plugin configuration, alter optimization settings, or delete data, disrupting site performance and exposing operational details.

Affected Products

WP Compress – Instant Performance & Speed Optimization plugin for WordPress versions up to and including 6.30.15
WordPress sites that allow user registration at the Subscriber role or higher
Multisite WordPress installations running vulnerable versions of the plugin

Discovery Timeline

2025-03-26 - CVE-2025-2110 published to the National Vulnerability Database (NVD)
2025-08-11 - Last updated in NVD database

Technical Details for CVE-2025-2110

Vulnerability Analysis

The WP Compress plugin registers multiple AJAX actions through wp_ajax_* hooks in classes/ajax.class.php. These handlers process requests from authenticated WordPress users but omit calls to current_user_can() or equivalent role checks. As a result, any logged-in user — including the lowest-privilege Subscriber role — can submit AJAX requests that reach administrative functionality.

The handlers expose operations including retrieval of plugin settings, modification of optimization configuration, and deletion of stored data. An attacker who registers a Subscriber account on a site with open registration gains the same effective reach into plugin internals as an administrator. Vendor remediation arrives in changeset 3254259, which introduces capability validation on the affected endpoints.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. Each affected AJAX handler verifies that a request is authenticated but does not verify that the caller holds an appropriate role or capability. WordPress treats wp_ajax_{action} hooks as available to any logged-in user unless the handler enforces capability checks itself.

Attack Vector

Exploitation requires a valid WordPress account with at least the Subscriber role. The attacker sends a crafted POST request to /wp-admin/admin-ajax.php specifying the vulnerable action parameter and any required nonce or parameters accepted by the handler. Because the request originates from an authenticated session, WordPress dispatches it to the vulnerable handler, which executes without confirming the caller's privileges.

The vulnerability is exploitable over the network without user interaction. See the WordPress Plugin Code File and the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-2110

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php from Subscriber-level user sessions referencing WP Compress AJAX actions
Changes to WP Compress configuration that were not initiated by an administrator, including modified API keys or disabled optimization features
Missing or reset plugin configuration entries in the wp_options table tied to WP Compress
New low-privilege user accounts created shortly before AJAX requests targeting the plugin

Detection Strategies

Review web server access logs for high-frequency POST requests to admin-ajax.php originating from a single authenticated session
Correlate WordPress audit logs with the user role of the requester to identify Subscriber accounts invoking administrative actions
Inspect the plugin version reported in readme.txt or via the WordPress admin to confirm whether the installed build is at or below 6.30.15

Monitoring Recommendations

Alert on AJAX actions registered by wp-compress-image-optimizer when called by non-administrator roles
Track configuration drift in plugin settings by hashing relevant wp_options rows and reviewing changes
Monitor user registration spikes on sites that allow open Subscriber registration

How to Mitigate CVE-2025-2110

Immediate Actions Required

Upgrade WP Compress – Instant Performance & Speed Optimization to a version newer than 6.30.15 that includes changeset 3254259
Audit existing user accounts and remove unrecognized Subscriber-level users
Review WP Compress configuration and restore any settings that were altered without authorization
Rotate any API keys or credentials stored in the plugin configuration that may have been disclosed

Patch Information

The vendor addressed the issue in the WP Compress plugin via changeset 3254259, which adds capability checks to the affected AJAX handlers. Site administrators should apply the update through the WordPress plugin installer. Refer to the plugin developer page for the latest release information.

Workarounds

Disable the WP Compress plugin until the patched version can be installed
Restrict new user registration or set the default role to a value that cannot reach admin-ajax.php with authenticated context where feasible
Deploy a web application firewall rule to block POST requests to admin-ajax.php carrying WP Compress action names from non-administrator sessions

bash

# Configuration example
# Disable open registration via wp-config or admin settings
wp option update users_can_register 0

# Update the vulnerable plugin to the patched release
wp plugin update wp-compress-image-optimizer