Server-Side Request Forgery Vulnerability in WP Compress Plugin

CVE-2025-2109

What is CVE-2025-2109?

The WP Compress plugin for WordPress is susceptible to Server-Side Request Forgery, affecting all versions up to and including 6.30.15. The vulnerability exists in the init() function, enabling unauthenticated adversaries to initiate web requests to arbitrary locations from the web application. This exploit could potentially allow attackers to access sensitive data from internal services, posing a significant risk to the security and confidentiality of affected sites.

References