PT-2024-31156 · WordPress · Wp Compress – Image Optimizer [All-In-One]
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
WP Compress – Image Optimizer [All-In-One] versions up to, and including, 6.20.01
Description
The issue allows authenticated attackers with subscriber-level permissions and above to modify data, including editing plugin settings and storing cross-site scripting, in multisite environments due to a missing capability check on several functions.
Recommendations
For WP Compress – Image Optimizer [All-In-One] versions up to, and including, 6.20.01, update to a version that includes a fix for the missing capability check to prevent unauthorized modification of data.
Fix
Missing Authorization
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wp Compress – Image Optimizer [All-In-One]