CVE-2025-7443

HIGH

BerqWP <= 2.2.42 - Unauthenticated Arbitrary File Upload

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-7443 has a selected CVSS score of 8.1 (high).

Description

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 23, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 1, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

berqwp

Browse berqier / berqwp
VulnCheckVersion data not supplied

BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript

Browse berqwp / BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript

Default status: unaffected

CVE ListThrough 2.2.42affected

References

4