CVE-2023-6699

An attacker sends a specially crafted HTTP request containing path traversal sequences (e.g., '../') in the 'css' parameter, which allow escaping the permitted directory and pointing to any file in the server's file system. The plugin does not properly validate the provided path, resulting in reading and returning the contents of the specified file. Since the attack does not require authentication, any network user can perform it.

An attacker can read the contents of any files accessible to the web server process, including WordPress configuration files (e.g., wp-config.php with database credentials), private keys, passwords, and other sensitive data stored on the server.

The WP Compress – Image Optimizer plugin should be updated to a version higher than 6.10.33, which introduces a fix for CSS parameter validation. The update can be performed directly from the WordPress admin panel or downloaded from the official plugin repository.

WP Compress – Image Optimizer [All-In-One] plugin for WordPress in all versions up to and including 6.10.33.