PT-2026-1600

CVE-2025-15158

·

Published

2026-01-06

·

Updated

2026-09-30

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WP Enable WebP versions up to and including 1.0
Description The WP Enable WebP plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation within the wpse file and ext webp function. This allows authenticated attackers with Author-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution.
Recommendations Versions up to and including 1.0: Update to version 1.1.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
CVE-2025-15158
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com