PT-2026-1600 · WordPress · Wp Enable Webp

Zast.Ai · CVE-2025-15158 · Published 2026-01-07 · Updated 2026-01-16

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Enable WebP versions up to and including 1.0

Description The WP Enable WebP plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation within the wpse file and ext webp function. This allows authenticated attackers with Author-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations Versions up to and including 1.0: Update to version 1.1.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-15158

Affected Products

Wp Enable Webp

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-15158 · Security Note
• https://twitter.com/cracbot/status/2010668133183533498 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fa53c5ee-fe7f-4fb2-baaa-2c1a151d4b2c?source=cve · Note
• https://twitter.com/TheHackerWire/status/2008916868573089903 · Twitter Post
• https://twitter.com/CVEnew/status/2008824742409638055 · Twitter Post
• https://twitter.com/EchoPulseSec/status/2012140956083249398 · Twitter Post
• https://twitter.com/RedPacketSec/status/2008927795028615533 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-enable-webp/trunk/wp-enable-webp.php?rev=1998897#L43 · Note
• https://t.me/CVEtracker/41592 · Telegram Post
• https://twitter.com/CveFindCom/status/2008881311729988065 · Twitter Post