CVE-2023-6699 is a critical directory traversal flaw in the WP Compress Image Optimizer plugin for WordPress. Through the css parameter, unauthenticated attackers can read arbitrary files on the server. The record lists versions up to 6.10.33, so update to a later release.
What's affected
- Product: WP Compress Image Optimizer, a WordPress plugin.
- Affected: all versions up to and including 6.10.33, per the record.
- Fixed version: not named in the record. A Trac changeset comparing two revisions is linked, so confirm the release in the changelog.
- Access needed: none, over the network (score 9.1).
The record gives a CVSS 3.1 base score of 9.1 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the plugin version on each site.
- Update to a release newer than 6.10.33.
- Check access logs for requests to the plugin that carry the css parameter with path like values.
- If the site was public while affected, rotate the database password and the keys and salts in wp-config.php, since that file is a typical target.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-24 (Path Traversal using the filedir pattern): A variant of path traversal in which special path sequences in a parameter let a request step outside the folder the code meant to read from. ; CWE-22 (Path Traversal): A path built from user input is not confined to the intended directory, so a request can reach files elsewhere on the server.
The record lists path traversal in two forms. A value from the css parameter is used as a file path without being kept inside the intended folder, so a request can name a file elsewhere on the server.
The impact is confidentiality only, but that includes configuration files with database credentials. Because no login is needed, every public site on an affected version is a candidate. Rotating secrets after the update matters, as a read leaves no trace on the file itself.
Quick check
Can it modify files?
The record describes reading arbitrary files only, with no integrity impact in the vector.
What should I rotate?
If the site was exposed, rotate database credentials and WordPress keys and salts, plus anything else stored in readable files.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
