CVE-2025-7443: BerqWP WordPress Plugin RCE Vulnerability

CVE-2025-7443 Overview

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress contains a critical arbitrary file upload vulnerability. The flaw exists due to missing file type validation in the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This vulnerability enables unauthenticated attackers to upload arbitrary files to the affected WordPress site's server, potentially leading to remote code execution.

Critical Impact

Unauthenticated attackers can upload malicious files including PHP webshells to gain complete control of the WordPress installation and underlying server, without any authentication required.

Affected Products

• BerqWP Plugin for WordPress versions up to and including 2.2.42
• WordPress installations using vulnerable BerqWP plugin versions
• Any web server hosting affected WordPress sites

Discovery Timeline

• 2025-08-01 - CVE-2025-7443 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-7443

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The BerqWP plugin's JavaScript caching functionality fails to implement proper file type validation, creating a direct pathway for attackers to upload executable files to the server. Since the upload endpoint does not require authentication, any remote attacker can exploit this flaw over the network.

The attack requires no user interaction and can be performed by unauthenticated users. While the attack complexity is considered high, successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system. An attacker who successfully uploads a malicious PHP file can execute arbitrary commands on the server with the privileges of the web server process.

Root Cause

The root cause lies in the store_javascript_cache.php API endpoint, which accepts file uploads without validating the file type, extension, or content. The plugin trusts user-supplied input and stores uploaded files directly to the server's file system without sanitization. This violates secure coding principles that mandate validation of all user-supplied data, particularly file uploads which can contain executable code.

The vulnerable code path allows files to be written to accessible locations within the WordPress installation directory structure, enabling uploaded PHP files to be subsequently accessed and executed via HTTP requests.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can craft a malicious HTTP request to the store_javascript_cache.php endpoint, uploading a file with arbitrary content. The vulnerability can be exploited as follows:

1. The attacker identifies a WordPress site running a vulnerable version of the BerqWP plugin
2. A crafted HTTP POST request is sent to the vulnerable API endpoint (/wp-content/plugins/[plugin-path]/api/store_javascript_cache.php)
3. The request contains a malicious file payload, such as a PHP webshell, with a .php extension
4. The server accepts and stores the file without validation
5. The attacker accesses the uploaded file via its URL, triggering code execution

The vulnerability allows full remote code execution once a malicious PHP file is uploaded and accessed. This can lead to complete server compromise, data exfiltration, deployment of malware, or use of the compromised server as a pivot point for further attacks.

Detection Methods for CVE-2025-7443

Indicators of Compromise

• Unexpected PHP files appearing in WordPress cache directories or plugin folders
• HTTP POST requests to store_javascript_cache.php from unknown or suspicious IP addresses
• Web server logs showing access patterns to newly created PHP files in cache directories
• Presence of webshell signatures or obfuscated PHP code in plugin directories

Detection Strategies

• Monitor file system changes in WordPress plugin directories for new PHP file creation
• Implement Web Application Firewall (WAF) rules to block suspicious file upload attempts to BerqWP plugin endpoints
• Review web server access logs for unusual POST requests to store_javascript_cache.php
• Deploy file integrity monitoring solutions to detect unauthorized file modifications in WordPress installations

Monitoring Recommendations

• Enable detailed logging for all HTTP requests to WordPress plugin API endpoints
• Configure alerts for PHP file creation events in plugin and cache directories
• Implement real-time monitoring for webshell signatures and patterns in uploaded files
• Regularly audit WordPress plugin versions against known vulnerability databases

How to Mitigate CVE-2025-7443

Immediate Actions Required

• Update BerqWP plugin to a version newer than 2.2.42 that addresses this vulnerability
• If patching is not immediately possible, temporarily disable the BerqWP plugin until a fix can be applied
• Review web server logs and file systems for indicators of exploitation
• Scan WordPress installations for unauthorized PHP files or webshells

Patch Information

The vulnerability has been addressed in the BerqWP plugin. According to the WordPress Plugin Changeset Update, modifications were made to the API registration to remediate this security issue. Site administrators should update to the latest available version of the plugin through the WordPress plugin repository.

For additional details on this vulnerability, consult the Wordfence Vulnerability Report and the WordPress Plugin Code Review showing the vulnerable code path.

Workarounds

• Block access to store_javascript_cache.php via web server configuration (.htaccess for Apache or server block for Nginx)
• Implement WAF rules to reject file upload requests to the vulnerable endpoint
• Restrict PHP execution in cache and upload directories using server configuration
• Consider temporary plugin deactivation if no critical dependency exists on the caching functionality

# Apache .htaccess workaround to block access to vulnerable endpoint
<Files "store_javascript_cache.php">
    Order Allow,Deny
    Deny from all
</Files>

# Nginx configuration to block access
location ~* /wp-content/plugins/.*/api/store_javascript_cache\.php$ {
    deny all;
    return 403;
}