CVE-2025-15158: 
WordPress vulnerability analysis and mitigation

CVE-2025-15158 is an arbitrary file upload vulnerability in the WP Enable WebP plugin for WordPress, caused by improper file type validation in the wpse_file_and_ext_webp function. It affects all versions of the plugin up to and including version 1.0. The vulnerability was disclosed on January 7, 2026, with Wordfence as the assigning CNA. It carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, NVD).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), stemming from insufficient validation in the wpse_file_and_ext_webp function within wp-enable-webp.php (line 43, revision 1998897). The function fails to properly restrict the types of files that can be uploaded, allowing attackers to bypass expected WebP-only restrictions and upload arbitrary file types, including server-executable scripts. Exploitation requires network access and authentication at the Author level or above, with no user interaction needed (Wordfence, WordPress Trac).

Successful exploitation allows authenticated attackers with Author-level or higher privileges to upload arbitrary files — including PHP web shells — to the server, potentially enabling remote code execution. This could lead to full compromise of the WordPress installation, unauthorized access to sensitive data stored on the server, and use of the compromised host as a pivot point for further attacks. Confidentiality, integrity, and availability are all rated as high impact (Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.234%, indicating a low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the WP Enable WebP plugin version 1.0 or earlier, using tools like WPScan or by checking publicly accessible plugin metadata.
2. Obtain Author-level credentials: Register or compromise an account with at least Author-level privileges on the target WordPress site (e.g., via credential stuffing, phishing, or brute force).
3. Craft malicious upload request: Prepare a PHP web shell or other malicious file disguised or submitted through the plugin's file upload functionality that invokes the vulnerable wpse_file_and_ext_webp function.
4. Bypass file type validation: Submit the file via the plugin's upload mechanism; due to improper validation in wpse_file_and_ext_webp, the server accepts the file without enforcing WebP-only restrictions.
5. Achieve remote code execution: Access the uploaded file via its URL on the server (e.g., in the WordPress uploads directory) to execute arbitrary commands, establish a reverse shell, or exfiltrate data (Wordfence, WordPress Trac).

• File System: Unexpected non-WebP files (e.g., .php, .phtml, .php5) in the WordPress uploads directory (/wp-content/uploads/); presence of web shell scripts with obfuscated PHP code.
• Network: Unusual HTTP GET or POST requests to newly uploaded files in the uploads directory; outbound connections from the web server process to unknown external IPs.
• Logs: WordPress or web server access logs showing POST requests to plugin upload endpoints followed by GET requests to .php files in the uploads directory; PHP error logs indicating execution of unexpected scripts.
• Process: Unusual child processes spawned by the web server (e.g., bash, curl, wget, python) that are not typical for normal WordPress operation.

As of the disclosure date, no patched version of the WP Enable WebP plugin beyond 1.0 has been confirmed as available; users should monitor the WordPress plugin repository for updates (Wordfence). In the interim, site administrators should disable or remove the WP Enable WebP plugin if it is not actively required. Additional mitigations include restricting Author-level and above roles to trusted users only, implementing web server-level rules to block execution of scripts in the uploads directory, and deploying a Web Application Firewall (WAF) with rules targeting suspicious file upload patterns.

Wordfence published the vulnerability in their weekly WordPress vulnerability report for the week of January 5–11, 2026, and included it in their threat intelligence database (Wordfence Blog). The vulnerability was also referenced in the CISA vulnerability bulletin for the week of January 5, 2026 (CISA Bulletin). Social media accounts such as RedPacketSecurity shared the CVE on Mastodon and Twitter/X shortly after disclosure, and it was noted in aggregator blogs covering high-CVSS CVEs published on January 7, 2026.