CVE-2023-6812
📋 TL;DR
The WP Compress Image Optimizer WordPress plugin contains an open redirect vulnerability that allows unauthenticated attackers to redirect users to malicious websites. This affects all WordPress sites using the plugin version 6.20.01 or earlier. Attackers can exploit this by tricking users into clicking specially crafted links.
💻 Affected Systems
- WP Compress - Image Optimizer WordPress plugin
📦 What is this software?
Wp Compress by Wpcompress
⚠️ Risk & Real-World Impact
Worst Case
Users are redirected to phishing sites that steal credentials or deliver malware, leading to account compromise or system infection.
Likely Case
Users are redirected to spam, advertising, or low-risk malicious sites, potentially damaging trust in the legitimate website.
If Mitigated
With proper user awareness training and web filtering, impact is limited to minor user confusion or inconvenience.
🎯 Exploit Status
Exploitation requires user interaction (clicking a link) but is technically simple for attackers to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 6.20.01
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3082085/wp-compress-image-optimizer/trunk/fixCss.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Compress - Image Optimizer. 4. Click 'Update Now' if available, or manually update to latest version. 5. Verify plugin is updated to version newer than 6.20.01.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the WP Compress plugin until patched
wp plugin deactivate wp-compress-image-optimizer
Web Application Firewall rule
allBlock requests containing malicious redirect parameters
WAF-specific configuration to block suspicious 'css' parameter values
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to restrict redirect destinations
- Deploy web application firewall with open redirect protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > WP Compress - Image Optimizer version numberCheck Version:
wp plugin get wp-compress-image-optimizer --field=versionVerify Fix Applied:
Verify plugin version is newer than 6.20.01 and test redirect functionality📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'css' parameter containing external domains
- Unusual redirect patterns in access logs
Network Indicators:
- HTTP 302/301 redirects to unexpected external domains
- Suspicious referrer patterns
SIEM Query:
web_access_logs WHERE url CONTAINS 'css=' AND (url CONTAINS 'http://' OR url CONTAINS 'https://') AND NOT url CONTAINS 'wordpress.org'🔗 References
- https://plugins.trac.wordpress.org/changeset/3082085/wp-compress-image-optimizer/trunk/fixCss.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cbbf9fbb-74fd-42eb-a781-2a720fe56b13?source=cve
- https://plugins.trac.wordpress.org/changeset/3082085/wp-compress-image-optimizer/trunk/fixCss.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cbbf9fbb-74fd-42eb-a781-2a720fe56b13?source=cve
