CVE-2025-27316: WP-Image-Compression CSRF Vulnerability

CVE-2025-27316 Overview

CVE-2025-27316 is a Cross-Site Request Forgery (CSRF) vulnerability in the hosting.io JPG, PNG Compression and Optimization WordPress plugin (wp-image-compression). The flaw affects all plugin versions up to and including 1.7.35. An attacker can trick an authenticated user into submitting a forged request that performs unintended actions within the plugin. The issue is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, typically achieved by luring a logged-in WordPress user to a malicious page. The vulnerability was published to the National Vulnerability Database (NVD) on February 24, 2025.

Critical Impact
An attacker can perform unauthorized state-changing actions in the plugin by abusing an authenticated user's session, potentially altering image compression settings on affected WordPress sites.

Affected Products

hosting.io JPG, PNG Compression and Optimization (wp-image-compression) plugin for WordPress
All versions from n/a through 1.7.35
WordPress sites running the vulnerable plugin with authenticated administrators

Discovery Timeline

2025-02-24 - CVE-2025-27316 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27316

Vulnerability Analysis

The vulnerability stems from missing or improperly implemented CSRF protections in the wp-image-compression plugin. State-changing actions in the plugin do not adequately verify that a request originated from a legitimate, user-initiated action within the WordPress admin interface. WordPress provides nonce mechanisms (wp_nonce_field, check_admin_referer, wp_verify_nonce) to defend against CSRF, and this vulnerability class typically arises when those checks are absent or applied inconsistently.

An attacker crafts a malicious HTML page or link that triggers a request to a vulnerable plugin endpoint. When an authenticated WordPress administrator visits the attacker-controlled page, the browser automatically attaches the admin's session cookies to the request. The request executes with the administrator's privileges, altering plugin settings or triggering plugin actions without consent. The UI:R requirement in the CVSS vector reflects the need to social-engineer an authenticated user into visiting the malicious content.

Root Cause

The root cause is missing anti-CSRF token validation on privileged plugin actions. Requests are processed based solely on session authentication cookies, which browsers send automatically on cross-origin requests. Without a nonce tied to the user's session and verified server-side, the plugin cannot distinguish between requests originating from its legitimate admin UI and requests forged by an external site.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a malicious page containing an auto-submitting form or hidden request targeting the vulnerable plugin endpoint on the victim's WordPress site. The victim, while logged into WordPress as an administrator, visits the page. The forged request executes plugin actions using the victim's authenticated session. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-27316

Indicators of Compromise

Unexpected modifications to wp-image-compression plugin settings without corresponding admin activity in audit logs
HTTP POST or GET requests to plugin admin endpoints with Referer headers pointing to external, untrusted domains
Administrator sessions triggering plugin actions immediately after visiting external links or email attachments

Detection Strategies

Review WordPress access logs for requests to wp-admin endpoints associated with wp-image-compression that carry off-site or missing Referer headers
Enable and monitor WordPress audit logging plugins to track configuration changes tied to plugin settings
Correlate authenticated admin activity with browser navigation history to identify suspicious cross-site triggers

Monitoring Recommendations

Alert on plugin configuration changes occurring outside normal administrative maintenance windows
Monitor for anomalous POST requests to plugin endpoints lacking valid nonce parameters (_wpnonce)
Track and alert on WordPress administrator sessions issuing requests with external Origin or Referer headers

How to Mitigate CVE-2025-27316

Immediate Actions Required

Deactivate the wp-image-compression plugin until a patched version is confirmed installed
Instruct WordPress administrators to log out of admin sessions before browsing untrusted sites
Audit plugin settings and revert any unauthorized configuration changes
Enforce least-privilege on WordPress user roles to reduce the blast radius of any successful CSRF

Patch Information

At the time of the NVD entry, the advisory covers versions up to and including 1.7.35. Consult the Patchstack advisory for the latest fixed version information and upgrade to a release that implements nonce validation on all state-changing plugin actions.

Workarounds

Restrict access to /wp-admin by IP address using web server rules or a Web Application Firewall (WAF)
Deploy a WAF ruleset that enforces Referer and Origin header validation on WordPress admin requests
Require administrators to use dedicated browser profiles or sessions when performing WordPress administration
Disable the plugin if image compression is not actively required in production

bash

# Example nginx configuration to restrict wp-admin access by IP
location ~ ^/wp-admin/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    try_files $uri $uri/ /index.php?$args;
}