CVE-2025-2109 is a Server-Side Request Forgery (SSRF) vulnerability affecting the WP Compress – Instant Performance & Speed Optimization WordPress plugin up to version 6.30.15. The flaw exists in the init() function, enabling unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations. This can be leveraged to query internal services that are otherwise inaccessible externally. The vulnerability has a CVSS 3.1 base score of 5.8, reflecting medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality impact.

An attacker can exploit this SSRF vulnerability to make the vulnerable server perform HTTP requests to arbitrary destinations, including internal network resources. This may allow information disclosure from internal services that are not directly accessible from the internet. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting outbound HTTP requests from the server hosting the plugin as a temporary mitigation. Monitor for updates from the plugin vendor regarding patches or official fixes.