CVE-2025-47546: WP Compress CSRF Vulnerability

CVE-2025-47546 Overview

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WP Compress (wp-compress-image-optimizer) WordPress plugin developed by AresIT. This vulnerability allows attackers to perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious webpage or clicking a crafted link. The lack of proper CSRF token validation enables attackers to potentially compromise the confidentiality, integrity, and availability of affected WordPress installations.

Critical Impact

Attackers can execute unauthorized administrative actions on WordPress sites running vulnerable versions of WP Compress, potentially leading to complete site compromise, data theft, or service disruption.

Affected Products

• WP Compress (wp-compress-image-optimizer) versions up to and including 6.30.30
• WordPress installations using the affected WP Compress plugin
• Sites relying on WP Compress for image optimization functionality

Discovery Timeline

• 2025-05-07 - CVE-2025-47546 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-47546

Vulnerability Analysis

This Cross-Site Request Forgery vulnerability exists due to insufficient validation of request origins within the WP Compress WordPress plugin. When users with administrative privileges interact with the plugin's functionality, the application fails to verify that requests originated from legitimate sources within the WordPress admin interface. This oversight allows malicious actors to craft requests that, when executed by an authenticated administrator, perform sensitive operations without the user's knowledge or consent.

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), which describes a class of attacks where an attacker forces an authenticated user's browser to send a forged HTTP request, including session cookies and authentication information, to a vulnerable web application. In the context of WordPress plugins, this can lead to unauthorized configuration changes, plugin setting modifications, or other administrative actions.

Root Cause

The root cause of this vulnerability lies in the WP Compress plugin's failure to implement proper anti-CSRF mechanisms. WordPress provides built-in nonce (number used once) functionality specifically designed to prevent CSRF attacks. When plugins fail to generate and validate these nonces for state-changing operations, they become susceptible to forged requests. The vulnerable versions of WP Compress do not adequately implement these security checks, leaving critical plugin operations unprotected.

Attack Vector

The attack requires user interaction—specifically, an authenticated WordPress administrator must be tricked into visiting a malicious webpage or clicking a crafted link while logged into their WordPress site. The attacker crafts an HTML page containing hidden forms or JavaScript that automatically submits requests to the target WordPress site. When the victim visits the attacker's page, their browser automatically includes authentication cookies with the forged requests, causing the WordPress site to process them as legitimate administrative actions.

A typical attack scenario involves the attacker sending a phishing email or social engineering message containing a link to a malicious page. The page contains hidden iframes or auto-submitting forms targeting WP Compress plugin endpoints. Since the victim's browser includes their WordPress session cookies, the vulnerable plugin processes these forged requests as if they were intentionally submitted by the administrator.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-47546

Indicators of Compromise

• Unexpected changes to WP Compress plugin settings or configurations
• Unusual plugin activity logged during periods when administrators were not actively managing the site
• Modified image compression settings without corresponding administrator actions
• Unexplained outbound requests from the WordPress server

Detection Strategies

• Monitor WordPress admin activity logs for plugin configuration changes occurring from unexpected IP addresses or user agents
• Implement Content Security Policy (CSP) headers to detect and block unauthorized cross-origin requests
• Use web application firewalls (WAF) to identify and alert on suspicious request patterns targeting WP Compress endpoints
• Review server access logs for requests to WP Compress plugin files originating from external referrers

Monitoring Recommendations

• Enable WordPress audit logging to track all plugin configuration changes with timestamp and user context
• Configure alerting for administrative actions on the WP Compress plugin outside of normal maintenance windows
• Deploy real-time monitoring solutions capable of detecting CSRF attack patterns
• Regularly review and correlate user session activity with plugin modification events

How to Mitigate CVE-2025-47546

Immediate Actions Required

• Update WP Compress plugin to a version newer than 6.30.30 that addresses the CSRF vulnerability
• Review recent plugin configuration changes for any unauthorized modifications
• Audit administrator accounts for signs of compromise or unauthorized access
• Consider temporarily deactivating the WP Compress plugin until a patched version is installed

Patch Information

Site administrators should check the WordPress plugin repository for an updated version of WP Compress that addresses this CSRF vulnerability. The fix typically involves implementing proper WordPress nonce validation on all state-changing plugin operations. Refer to the Patchstack Vulnerability Report for the latest patch status and update guidance.

Workarounds

• Implement additional WAF rules to validate referer headers and block cross-origin requests to WP Compress plugin endpoints
• Limit administrative access to the WordPress dashboard from trusted IP addresses only
• Use browser extensions that provide CSRF protection for administrative sessions
• Enable two-factor authentication for all WordPress administrator accounts to add an extra layer of security

# WordPress plugin update via WP-CLI
wp plugin update wp-compress-image-optimizer

# Verify current plugin version
wp plugin get wp-compress-image-optimizer --field=version

# Temporarily deactivate plugin if update unavailable
wp plugin deactivate wp-compress-image-optimizer