CVE-2025-15158
Arbitrary File Upload in WP Enable WebP Plugin Enables RCE
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | wp_enable_webp | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the WP Enable WebP WordPress plugin (up to version 1.0) due to improper file type validation in the 'wpse_file_and_ext_webp' function. Authenticated users with Author-level access or higher can exploit this flaw to upload arbitrary files to the server. Because the plugin does not correctly validate file types, attackers can upload malicious files that could lead to remote code execution on the affected site.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker with Author-level access or above to upload arbitrary files to your WordPress server. This can lead to remote code execution, potentially allowing the attacker to take control of your website, deface content, steal data, or use your server for malicious activities.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update or remove the WP Enable WebP plugin if it is at version 1.0 or below. Restrict upload permissions to trusted users only, especially limiting Author-level access. Monitor and audit file uploads for suspicious or unexpected file types. Consider disabling the plugin until a patched version is available to prevent arbitrary file uploads that could lead to remote code execution.