CVE-2025-15158
HIGHWP Enable WebP <= 1.0 - Authenticated Arbitrary File Upload via wpse_file_and_ext_webp Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-15158. PoCs published by exploitChains.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-15158, an arbitrary file upload vulnerability in the WordPress plugin WP Enable WebP <= 1.0. The exploit leverages flawed file extension validation to upload a malicious PHP file disguised as a WebP image, achieving remote code execution.
Description
The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (1)
This repository contains a functional exploit for CVE-2025-15158, an arbitrary file upload vulnerability in the WordPress plugin WP Enable WebP <= 1.0. The exploit leverages flawed file extension validation to upload a malicious PHP file disguised as a WebP image, achieving remote code execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H