# WP Compress <= 7.30.00 - Unauthenticated Full Path Disclosure via Next-Gen Image Redirect Rule

- **ID:** WPSEC-2026-2235
- **Plugin:** WP Compress – Instant Performance & Speed Optimization (`wp-compress-image-optimizer`), https://wordpress.org/plugins/wp-compress-image-optimizer/
- **Affected versions:** all versions before 7.30.30
- **Fixed in:** 7.30.30 (Update to 7.30.30 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-compress-image-optimizer
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2235/

## Description

The WP Compress plugin for WordPress is vulnerable to Full Path Disclosure via the uploads fast-404 rewrite rules in all versions up to, and including, 7.30.00, due to the rule that redirects a request for a missing AVIF/WebP variant to its source image using a relative substitution in the uploads/.htaccess file without a RewriteBase, so Apache places the uploads directory's filesystem path in the redirect's Location header. This makes it possible for unauthenticated attackers to learn the server's absolute filesystem path on Apache and LiteSpeed sites where these rules are active (they are on by default), which can help with other attacks.

## References

- https://wpsec.com/vuln/WPSEC-2026-2235/
- https://plugins.svn.wordpress.org/wp-compress-image-optimizer/tags/7.30.30/
- https://wordpress.org/plugins/wp-compress-image-optimizer/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2235/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.