CVE-2024-4445: 
WordPress vulnerability analysis and mitigation

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress contains a vulnerability (CVE-2024-4445) discovered in versions up to and including 6.20.01. The vulnerability was disclosed on May 14, 2024, affecting the plugin's capability checking mechanism (NVD).

The vulnerability stems from a missing capability check on several functions in the plugin, which affects multisite environments. The severity is rated as MEDIUM with a CVSS v3.1 base score of 6.5 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) (Wordfence).

The vulnerability allows authenticated attackers with subscriber-level permissions or higher to modify plugin settings. This includes the ability to store cross-site scripting payloads in multisite environments, potentially affecting the security of the WordPress installation (NVD).

The vulnerability requires authentication with at least subscriber-level access. Once authenticated, an attacker can exploit the missing capability checks to modify plugin settings and potentially inject malicious content (Wordfence).

Users should update to a version newer than 6.20.01 which contains the security fix. The vulnerability was addressed through the implementation of proper capability checks as evidenced in the plugin's source code changes (WordPress Plugin).