CVE-2025-7443: BerqWP <= 2.2.42 - Unauthenticated Arbitrary File Upload
The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the storejavascriptcache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7443?
CVE-2025-7443 has a high severity rating due to its potential for arbitrary file uploads.
How do I fix CVE-2025-7443?
To fix CVE-2025-7443, ensure you update the BerqWP plugin to version 2.2.43 or later where the vulnerability is patched.
Who is affected by CVE-2025-7443?
All users of the BerqWP plugin for WordPress versions up to 2.2.42 are affected by CVE-2025-7443.
What type of vulnerability is CVE-2025-7443?
CVE-2025-7443 is classified as an arbitrary file upload vulnerability due to missing file type validation.
What component of the BerqWP plugin is vulnerable in CVE-2025-7443?
The vulnerability in CVE-2025-7443 exists in the store_javascript_cache.php file of the BerqWP plugin.