Auth bypass in Aresit Wp Compress – Instant Performance & Speed Optimization
CVE-2025-2110
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
Vulnerability class: Broken Access Control
EPSS: 0.004 (34.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Product)
- security@wordfence.com (Release Notes)
- security@wordfence.com (Product)
Frequently asked questions
- What is CVE-2025-2110?
- CVE-2025-2110 is a high-severity vulnerability in Aresit Wp Compress – Instant Performance & Speed Optimization, classified under Missing Authorization. CVSS score: 8.8/10. Published 2025-03-26.
- How severe is CVE-2025-2110?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2025-2110 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.