CVE-2025-47479 is a medium severity weak authentication flaw (CVSS 5.3) in the WP Compress image optimizer plugin for WordPress, versions through 6.30.30. It lets authentication be abused without a login. Patchstack lists 6.30.31 as the patched version, so update to that or later.
What's affected
The record says WP Compress from AresIT, slug wp-compress-image-optimizer, is affected through 6.30.30. Patchstack lists 6.30.31 as the fixed version.
The vector shows network access, low complexity, no privileges and no user interaction. Only integrity is affected, and at a low level. That is why the score stays at 5.3 and not higher.
The record does not mark CVE-2025-47479 as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
On the server, WP-CLI shows the installed version and whether the plugin is active:
wp plugin list --name=wp-compress-image-optimizer --fields=name,version,status,update
If WP-CLI is not available, open Plugins in the WordPress admin and read the version under the plugin name. Compare it with the affected range above. A deactivated plugin is lower risk than an active one, but it still sits on disk, so remove it if you do not use it.
Also check whether the plugin is still needed. Image optimization is often available from your host or a CDN, and fewer plugins means fewer advisories to track.
What to do now
- Update WP Compress to 6.30.31 or later. With WP-CLI that is
wp plugin update wp-compress-image-optimizer. - Take a backup first if the site is busy, and test the update on a staging copy when you can.
- If you do not use the plugin, deactivate and delete it.
- After updating, check the plugin's settings and your media library for changes you did not make.
- Review your plugin list for anything else that is out of date. Old plugins are where most WordPress incidents begin.
- Turn on automatic updates for plugins you trust, or add a regular review to your calendar.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record classifies this as CWE-1390, weak authentication. The record does not explain the mechanism, and I could not find more detail, so the exact check that is too weak is not described here. What the classification tells you is that something used to prove identity can be satisfied too easily.
A medium score should not make you relax. Weak authentication flaws often decide whether a plugin's other features are protected at all. Update promptly, and keep the plugin list short.
WordPress plugins run with the same trust as the rest of the site. A weakness in one small add on is a weakness in the whole install, and plugin flaws are easy to find at scale because the code is public and the plugin slugs are predictable.
Quick check
Is CVE-2025-47479 fixed?
Patchstack lists 6.30.31 as the patched version of WP Compress. Update to 6.30.31 or later.
Why is the score only medium?
The vector shows only a low integrity impact and no confidentiality or availability impact, even though no login is needed.
Sources
Last reviewed: 18 October 2026.
