CVE-2025-7443

Sažetak

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Reference

https://plugins.trac.wordpress.org/browser/searchpro/trunk/api/store_javascript_cache.php#L14
https://plugins.trac.wordpress.org/changeset/3330075/searchpro/trunk/api/register_apis.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7dc644-ab83-4f03-998a-ec8eda695161?source=cve

CVSS

Base:	8.1
Impact:	5.9
Exploitability:	2.2

Pristup

Vektor	Složenost	Autentikacija
NETWORK	HIGH	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
HIGH	HIGH	HIGH

CVSS vektor

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Zadnje važnije ažuriranje

01-08-2025 - 05:15

Objavljeno

01-08-2025 - 05:15