CVE-2025-47546
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in the AresIT WP Compress WordPress plugin allows attackers to trick authenticated administrators into performing unintended actions. This affects all WordPress sites using WP Compress versions up to 6.30.30. Attackers could modify plugin settings or potentially perform other administrative actions.
💻 Affected Systems
- AresIT WP Compress Image Optimizer
📦 What is this software?
Wp Compress by Wpcompress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could reconfigure image optimization settings to degrade site performance, modify security settings, or potentially chain with other vulnerabilities for further compromise.
Likely Case
Attackers trick administrators into changing plugin settings, potentially disrupting image optimization or site functionality.
If Mitigated
With proper CSRF protections and user awareness, exploitation attempts would fail or be detected.
🎯 Exploit Status
CSRF attacks typically require social engineering to trick authenticated users; no authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.30.31 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Compress and click 'Update Now'. 4. Verify update to version 6.30.31 or later.
🔧 Temporary Workarounds
Implement CSRF Protection Headers
allAdd Content Security Policy headers to help prevent CSRF attacks
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
Temporary Plugin Deactivation
linuxDisable WP Compress until patched if immediate update not possible
wp plugin deactivate wp-compress-image-optimizer
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and CSRF tokens site-wide
- Educate administrators about phishing risks and require manual confirmation for sensitive actions
🔍 How to Verify
Check if Vulnerable:
Check WP Compress version in WordPress admin under Plugins > Installed PluginsCheck Version:
wp plugin get wp-compress-image-optimizer --field=versionVerify Fix Applied:
Confirm WP Compress version is 6.30.31 or higher in plugin details📡 Detection & Monitoring
Log Indicators:
- Multiple failed CSRF token validations
- Unexpected plugin setting changes in WordPress logs
Network Indicators:
- POST requests to wp-admin/admin-ajax.php without proper referrer headers
- Suspicious cross-origin requests to plugin endpoints
SIEM Query:
source="wordpress" AND (event="csrf_validation_failed" OR plugin="wp-compress")