CVE-2025-57899: WP Compress Authorization Bypass Flaw

CVE-2025-57899 Overview

CVE-2025-57899 is a Missing Authorization vulnerability [CWE-862] in the AresIT WP Compress plugin (wp-compress-image-optimizer) for WordPress. The flaw affects all versions up to and including 6.50.54. Unauthenticated attackers can reach plugin functionality that should be restricted by access control lists (ACLs), leading to a low-impact effect on availability. The vulnerability is exploitable over the network without user interaction or prior authentication. Site operators running the affected plugin should update to a patched release once available and audit request logs for anomalous plugin endpoint access.

Critical Impact
Unauthenticated attackers can invoke plugin functionality that lacks proper authorization checks, degrading site availability on WordPress installations using wp-compress-image-optimizer through version 6.50.54.

Affected Products

AresIT WP Compress (wp-compress-image-optimizer) WordPress plugin
All versions from initial release through 6.50.54
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2025-09-22 - CVE-2025-57899 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57899

Vulnerability Analysis

The vulnerability is a Broken Access Control issue in the wp-compress-image-optimizer plugin. One or more plugin handlers execute privileged operations without verifying the caller's role, capability, or nonce. This mirrors the classic Missing Authorization pattern tracked as [CWE-862], where enforcement logic is absent rather than incorrectly implemented.

Because the attack vector is Network with no authentication or user interaction required, an attacker can send crafted HTTP requests directly to the plugin's exposed endpoints. The confidentiality and integrity impacts are rated None, while availability shows a Low impact, indicating the reachable functionality primarily affects service state rather than data exposure. EPSS data places exploitation probability at 0.434%.

Root Cause

The root cause is the absence of capability checks such as current_user_can() and nonce verification via check_ajax_referer() or wp_verify_nonce() on plugin AJAX or REST handlers. Without these guards, WordPress dispatches the request to the handler regardless of the caller's identity. Any function reachable through the plugin's registered hooks becomes callable by unauthenticated clients.

Attack Vector

An attacker sends HTTP POST or GET requests to WordPress AJAX endpoints such as /wp-admin/admin-ajax.php or REST routes registered by the plugin. The target action parameter corresponds to a plugin handler lacking authorization checks. The server invokes the handler and performs the underlying operation, which can trigger state changes that affect availability. Refer to the Patchstack Vulnerability Report for handler-level details.

Detection Methods for CVE-2025-57899

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing WP Compress plugin actions
Requests to plugin REST routes originating from clients without valid session cookies or authorization headers
Sudden spikes in requests targeting wp-compress-image-optimizer handlers from a small number of source IPs

Detection Strategies

Inspect web server access logs for anonymous access to plugin AJAX actions and REST endpoints registered by wp-compress-image-optimizer.
Enable WordPress plugin auditing to record which user (or unauthenticated) invoked each plugin action.
Correlate abnormal availability events on WordPress sites with prior plugin endpoint requests.

Monitoring Recommendations

Alert on repeated admin-ajax.php requests with the plugin's action parameter and no authenticated session.
Track HTTP 200 responses to plugin endpoints originating from IPs that have never authenticated to the site.
Monitor WordPress plugin update status to confirm remediation across all managed sites.

How to Mitigate CVE-2025-57899

Immediate Actions Required

Identify all WordPress sites running the wp-compress-image-optimizer plugin at version 6.50.54 or earlier.
Deactivate the plugin on affected sites until a patched version is installed if the plugin is not business-critical.
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the web application firewall (WAF) layer where feasible.

Patch Information

As of the latest NVD update, the vendor's fixed version was not published in the CVE record. Site administrators should upgrade to the most recent release of WP Compress published after 6.50.54 and verify the changelog references the Broken Access Control fix. Consult the Patchstack Vulnerability Report for current patch guidance.

Workarounds

Deploy WAF rules blocking unauthenticated requests to plugin AJAX actions associated with wp-compress-image-optimizer.
Enforce IP allowlisting for /wp-admin/ administrative paths where operational requirements permit.
Remove the plugin entirely from sites that do not require image optimization functionality until remediation is confirmed.

bash

# Example WAF rule (ModSecurity) to block anonymous access to plugin actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1057899,\
   msg:'CVE-2025-57899 - Unauthenticated WP Compress action blocked'"
SecRule ARGS:action "@rx ^wpc_" \
  "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in_* "@eq 0"