CVE-2025-15158: WP Enable WebP Plugin RCE Vulnerability

CVE-2025-15158 Overview

The WP Enable WebP plugin for WordPress contains an arbitrary file upload vulnerability due to improper file type validation in the wpse_file_and_ext_webp function. This flaw affects all versions up to and including 1.0, allowing authenticated attackers with Author-level access or above to upload arbitrary files to the affected site's server. Successful exploitation may lead to remote code execution, enabling attackers to gain full control over the compromised WordPress installation.

Critical Impact
Authenticated attackers can upload malicious files (including PHP webshells) to achieve remote code execution on vulnerable WordPress sites running the WP Enable WebP plugin.

Affected Products

WP Enable WebP plugin for WordPress versions up to and including 1.0
WordPress installations with the WP Enable WebP plugin enabled
Sites where users have Author-level or higher privileges

Discovery Timeline

2026-01-07 - CVE CVE-2025-15158 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-15158

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw resides in the wpse_file_and_ext_webp function within the WP Enable WebP plugin, which fails to properly validate uploaded file types. While the plugin is designed to handle WebP image format conversions, inadequate validation allows attackers to bypass intended file type restrictions and upload arbitrary files, including executable scripts.

The vulnerability requires authentication with at least Author-level privileges, which means attackers need valid credentials or must compromise an existing user account. However, many WordPress sites have open registration or multiple contributors, making this access requirement less restrictive than it might initially appear.

Root Cause

The root cause of this vulnerability lies in improper file type validation within the wpse_file_and_ext_webp function. The plugin fails to adequately verify that uploaded files are legitimate WebP images, relying instead on insufficient checks that can be bypassed by attackers. This allows malicious files with dangerous extensions (such as .php) to be uploaded to the server.

Attack Vector

The attack is network-based and requires authenticated access with Author-level privileges or higher. An attacker would:

Authenticate to the WordPress site with Author or higher-level credentials
Interact with the WP Enable WebP plugin's file upload functionality
Craft a malicious file (e.g., PHP webshell) disguised to bypass validation
Upload the malicious file through the vulnerable function
Access the uploaded file directly to execute arbitrary code on the server

The vulnerability in the wpse_file_and_ext_webp function can be examined in the WordPress Plugin Source Code. The function fails to properly sanitize and validate file types, accepting files that should be rejected.

Detection Methods for CVE-2025-15158

Indicators of Compromise

Unexpected PHP files or other executable scripts in WordPress upload directories
Newly created files in /wp-content/uploads/ with suspicious extensions or content
Web server access logs showing requests to unusual files in upload directories
Unexpected outbound network connections from the web server

Detection Strategies

Monitor WordPress upload directories for newly created files with executable extensions (.php, .phtml, .php5, etc.)
Implement file integrity monitoring on WordPress installations to detect unauthorized file creation
Review web server access logs for POST requests to the WP Enable WebP plugin endpoints followed by GET requests to suspicious paths
Deploy web application firewalls (WAF) with rules to detect file upload attacks and webshell patterns

Monitoring Recommendations

Enable detailed logging for WordPress plugin activities and file operations
Configure alerts for any new PHP files created in upload directories
Monitor for suspicious process execution originating from the web server user account
Implement real-time file system monitoring using SentinelOne's endpoint protection capabilities

How to Mitigate CVE-2025-15158

Immediate Actions Required

Disable or remove the WP Enable WebP plugin immediately if running version 1.0 or earlier
Audit WordPress upload directories for any suspicious or unexpected files
Review user accounts with Author-level access or higher for signs of compromise
Consider implementing additional file upload restrictions at the web server level

Patch Information

At the time of publication, organizations should check for updates to the WP Enable WebP plugin. Review the Wordfence Vulnerability Report for the latest patching information and security advisories. Until a patched version is available, it is strongly recommended to disable the plugin.

Workarounds

Disable the WP Enable WebP plugin until a security patch is released
Restrict Author-level access to trusted users only and audit existing user roles
Implement server-side file type validation and restrictions in the web server configuration (e.g., Apache/Nginx rules to block PHP execution in upload directories)
Deploy a web application firewall with rules to block malicious file uploads

bash

# Apache configuration to prevent PHP execution in uploads directory
# Add to .htaccess in /wp-content/uploads/
<FilesMatch "\.(?i:php|php5|phtml|phps)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>