WP Compress <= 7.30.00 - Unauthenticated Full Path Disclosure via Next-Gen Image Redirect Rule
- ID
- WPSEC-2026-2235
- Plugin
- WP Compress – Instant Performance & Speed Optimization (wp-compress-image-optimizer)
- Affected
- all versions before 7.30.30
- Remediation
- Update to 7.30.30 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- WP Compress on WPSec AttackSurface
- Fix released
- Published
Description
The WP Compress plugin for WordPress is vulnerable to Full Path Disclosure via the uploads fast-404 rewrite rules in all versions up to, and including, 7.30.00, due to the rule that redirects a request for a missing AVIF/WebP variant to its source image using a relative substitution in the uploads/.htaccess file without a RewriteBase, so Apache places the uploads directory's filesystem path in the redirect's Location header. This makes it possible for unauthenticated attackers to learn the server's absolute filesystem path on Apache and LiteSpeed sites where these rules are active (they are on by default), which can help with other attacks.
References
- https://wpsec.com/vuln/WPSEC-2026-2235/
- https://plugins.svn.wordpress.org/wp-compress-image-optimizer/tags/7.30.30/
- https://wordpress.org/plugins/wp-compress-image-optimizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS