PatchTheCVECVE-2025-2109: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side R
CVE-2025-2109 is a medium-severity flaw (CVSS 5.8) affecting wp compress. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 66%) |
| CISA exploited list | No |
| Weakness | CWE-918 |
| Published | 2025-03-25 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-2109?
wp compress: upgrade to 6.30.16. Exact commands for each OS are on this page.
Is CVE-2025-2109 being exploited?
CVE-2025-2109 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-2109 affect?
CVE-2025-2109 affects wp compress. Severity is medium (CVSS 5.8). The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated a
How urgent is CVE-2025-2109?
Priority 34/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-47546 HIGH 7.1 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Cross
- CVE-2025-2110 HIGH 8.8 UPGRADE The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized
- CVE-2024-4445 MEDIUM 6.5 UPGRADE The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification
- CVE-2024-47384 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT W
- CVE-2024-32106 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress – Image Optimizer [All-In-One].This