{"id":"CVE-2025-8889","state":"PUBLISHED","title":"Compress Then Upload < 1.0.5 - Admin+ Arbitrary File Upload","description":"The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)","publishedAt":"2025-09-09T06:00:08.095Z","updatedAt":"2025-11-13T20:58:02.324Z","severity":{"score":3.8,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Compress & Upload"],"affected":[{"vendor":"Unknown","product":"Compress & Upload","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.5","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/5d84a577-62aa-4aa2-ac39-b146eae65243/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/8xxx/CVE-2025-8889.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-8889","state":"PUBLISHED","datePublished":"2025-09-09T06:00:08.095Z","dateUpdated":"2025-11-13T20:58:02.324Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2025-08-12T12:28:16.611Z"},"containers":{"cna":{"title":"Compress Then Upload < 1.0.5 - Admin+ Arbitrary File Upload","descriptions":[{"lang":"en","value":"The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)"}],"affected":[{"vendor":"Unknown","product":"Compress & Upload","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.5","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5d84a577-62aa-4aa2-ac39-b146eae65243/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2025-09-09T06:00:08.095Z"},"credits":[{"lang":"en","value":"Muhammed Çelik","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.8,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-09-09T19:36:31.528158Z","id":"CVE-2025-8889","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-11-13T20:58:02.324Z"}}]}}}