WordPress · Compress & Upload · CVE-2025-8889
Name of the Vulnerable Software and Affected Versions:
Compress & Upload WordPress plugin versions prior to 1.0.5
Description:
The Compress & Upload WordPress plugin does not properly validate uploaded files, allowing high privilege users, such as administrators, to upload arbitrary files to the server, even when restricted. This issue is particularly relevant in multisite setups.
Recommendations:
Update to Compress & Upload WordPress plugin version 1.0.5 or later.