CVE-2025-47546 describes a CSRF vulnerability in the AresIT WP Compress WordPress plugin (wp-compress-image-optimizer) affecting versions up to 6.30.30. This vulnerability enables attackers to induce authenticated users to execute unwanted actions via crafted requests, potentially impacting confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. No patch or official remediation guidance is currently available from the vendor, and no exploits have been reported in the wild.

Successful exploitation of this CSRF vulnerability could allow an attacker to perform unauthorized actions with the privileges of an authenticated user, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected WordPress site. The CVSS score of 7.1 reflects a high severity impact. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests and limiting user privileges where possible. Monitoring for vendor updates and applying patches promptly once available is recommended.