Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2025-8625

Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file types can be fetched and saved as attachments. As a result, unauthenticated attackers can forge a valid token to gain elevated privileges and upload an arbitrary file (e.g. a PHP script) through the image handler, leading to remote code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

copypressdev Copypress Rest API

Default version status: unaffected

  • 1.1 to ≤ 1.2affected

References