{
 "id": "WPSEC-2026-2235",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2235/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2235/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2235/index.md",
 "title": "WP Compress <= 7.30.00 - Unauthenticated Full Path Disclosure via Next-Gen Image Redirect Rule",
 "description": "The WP Compress plugin for WordPress is vulnerable to Full Path Disclosure via the uploads fast-404 rewrite rules in all versions up to, and including, 7.30.00, due to the rule that redirects a request for a missing AVIF/WebP variant to its source image using a relative substitution in the uploads/.htaccess file without a RewriteBase, so Apache places the uploads directory's filesystem path in the redirect's Location header. This makes it possible for unauthenticated attackers to learn the server's absolute filesystem path on Apache and LiteSpeed sites where these rules are active (they are on by default), which can help with other attacks.",
 "plugin": {
  "slug": "wp-compress-image-optimizer",
  "name": "WP Compress",
  "full_name": "WP Compress – Instant Performance & Speed Optimization",
  "wordpress_org": "https://wordpress.org/plugins/wp-compress-image-optimizer/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-compress-image-optimizer/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-compress-image-optimizer"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.30.30",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.30.30"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.30.30",
 "remediation": "Update to 7.30.30 or later.",
 "fix_released": "2026-10-30T20:57:55+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:52.167405+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2235/",
  "https://plugins.svn.wordpress.org/wp-compress-image-optimizer/tags/7.30.30/",
  "https://wordpress.org/plugins/wp-compress-image-optimizer/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-compress-image-optimizer",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}