CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Server Side Request Forgery.This issue affects WP Compress for MainWP: from n/a through <= 6.30.03.
Explanation of Vulnerability in Simple Terms
WP Compress for MainWP versions up to 6.30.03 contain a server-side request forgery vulnerability. An authenticated attacker with low privileges can make the site send requests to internal or external systems on their behalf. The vulnerability requires high attack complexity but can affect confidentiality and integrity. Update to a version newer than 6.30.03.
What an attacker can do
Make the site send HTTP requests to internal systems or external servers on the attacker's behalf.
Potential impact on your site
Attackers with low-privilege accounts could access internal services, read sensitive data, or modify external systems the site can reach.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
