CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
What the vulnerability does
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
WP Compress versions up to 6.10.33 contain a vulnerability allowing attackers to read and modify sensitive site data without authentication. The plugin fails to properly restrict access to critical functions, exposing user information and site configuration. No user interaction is required; attackers can exploit this remotely over the network.
What an attacker can do
Read and modify sensitive site data, including user information and configuration, without logging in.
Potential impact on your site
Attackers can access and alter user data, site settings, and other sensitive information without any credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
