Auth bypass in Aresit Wp Compress – Instant Performance & Speed Optimization
CVE-2025-2110
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and i…
Vulnerability class: Broken Access Control
EPSS: 0.004 (34.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Product)
- security@wordfence.com (Release Notes)
- security@wordfence.com (Product)
Frequently asked questions
- What is CVE-2025-2110?
- CVE-2025-2110 is a high-severity vulnerability in Aresit Wp Compress – Instant Performance & Speed Optimization, classified under Missing Authorization. CVSS score: 8.8/10. Published 2025-03-26.
- How severe is CVE-2025-2110?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2025-2110 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.