PT-2025-36576 · WordPress · Compress & Upload

Muhammed Çelik · Published 2025-09-09 · Updated 2026-01-28 · CVE-2025-8889

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Compress & Upload WordPress plugin versions prior to 1.0.5

Description: The Compress & Upload WordPress plugin does not properly validate uploaded files, allowing high privilege users, such as administrators, to upload arbitrary files to the server, even when restricted. This issue is particularly relevant in multisite setups.

Recommendations: Update to Compress & Upload WordPress plugin version 1.0.5 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-8889

Affected Products

Compress & Upload

References · 8

• 🔥 https://wpscan.com/vulnerability/5d84a577-62aa-4aa2-ac39-b146eae65243 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8889 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8889 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1965417958190067932 · Twitter Post
• https://twitter.com/CVEnew/status/1965299866172870967 · Twitter Post
• https://t.me/CVEtracker/32041 · Telegram Post
• https://t.me/cveNotify/134736 · Telegram Post
• https://t.me/cveNotify/150198 · Telegram Post