CVE-2025-2109

CVE-2025-2109 describes a Server-Side Request Forgery (SSRF) vulnerability in the WP Compress – Instant Performance & Speed Optimization WordPress plugin, affecting all versions up to and including 6.30.15. This flaw allows unauthenticated attackers to force the web application to make requests to arbitrary internal or external locations, potentially enabling information disclosure from internal services. The vulnerability carries a CVSS score of 5.8 (Medium), indicating a network-based attack with low complexity and no user interaction required, leading to potential confidentiality impacts. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 47/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has garnered minimal community discussion and media coverage, which is typical for the vast majority of reported vulnerabilities.