CRITICAL🇵🇱 Wersja polska

CVE-2023-6699

CVSS 9.1v3.1pub. 2024-01-11upd. 2026-04-08

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Wpcompress Wp Compress

    APP
    Wpcompress
    ≤ 6.10.33
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path TraversalAuth Bypass
CWE
References

Related vulnerabilities

CVE-2025-47546HIGH7.1ten sam produkt

Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Cross...

CVE-2025-2110HIGH8.8ten sam produkt

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized ...

CVE-2024-47384HIGH7.1ten sam produkt

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT W...

CVE-2024-1934HIGH7.5ten sam produkt

The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due ...

CVE-2025-47479MEDIUM5.3ten sam produkt

Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abus...