PatchTheCVECVE-2023-6812: The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versi
CVE-2023-6812 is a medium-severity flaw (CVSS 4.3) affecting wp compress. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 62%) |
| CISA exploited list | No |
| Weakness | CWE-601 |
| Published | 2024-05-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-6812?
wp compress: upgrade to 6.20.02. Exact commands for each OS are on this page.
Is CVE-2023-6812 being exploited?
CVE-2023-6812 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-6812 affect?
CVE-2023-6812 affects wp compress. Severity is medium (CVSS 4.3). The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. Th
How urgent is CVE-2023-6812?
Priority 25/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2025-47546 HIGH 7.1 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Cross
- CVE-2025-2110 HIGH 8.8 UPGRADE The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized
- CVE-2025-2109 MEDIUM 5.8 UPGRADE The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side R
- CVE-2024-4445 MEDIUM 6.5 UPGRADE The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification
- CVE-2024-47384 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT W