A CSRF flaw in the WP Compress image‑optimizer plugin allows an attacker to forge authenticated requests that the site processes as legitimate. Based on the description, it is inferred that the attacker could invoke any functionality that requires authentication, though the specific actions beyond credential forgery are not explicitly detailed.

The vulnerability affects WordPress sites that use the WP Compress plugin from any version up to and including 6.30.30, as released by AresIT. All installations of WP Compress within that version range are potentially exposed.

The CVSS score of 7.1 signals a high impact, while the EPSS value of less than 1% indicates that attacks are unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is web‑based; based on the description it is inferred that the attacker would need to trick an authenticated user into submitting a crafted request or clicking a malicious link to exploit the flaw. This requires the victim to be logged into the WordPress site and can lead to unauthorized actions performed as that user.