CVE-2025-8889
LOWCompress & Upload WordPress Plugin < 1.0.5 - Authenticated Arbitrary File Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-8889. PoCs published by siberkampus.
AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2025-8889, demonstrating an arbitrary file upload vulnerability in the WordPress 'Compress Then Upload' plugin (v1.0.3) that leads to remote code execution (RCE). The exploit involves bypassing weak server-side validation by intercepting and modifying an upload request to replace a benign image with malicious PHP code while retaining the original MIME type.
Description
The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Exploits (1)
This repository provides a functional proof-of-concept for CVE-2025-8889, demonstrating an arbitrary file upload vulnerability in the WordPress 'Compress Then Upload' plugin (v1.0.3) that leads to remote code execution (RCE). The exploit involves bypassing weak server-side validation by intercepting and modifying an upload request to replace a benign image with malicious PHP code while retaining the original MIME type.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N