CVE-2025-8625: Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution
The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreaphandleimage() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file types can be fetched and saved as attachments. As a result, unauthenticated attackers can forge a valid token to gain elevated privileges and upload an arbitrary file (e.g. a PHP script) through the image handler, leading to remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8625?
CVE-2025-8625 is classified as a critical vulnerability that allows for remote code execution.
How do I fix CVE-2025-8625?
To fix CVE-2025-8625, update the Copypress Rest API plugin to version 1.2 or later immediately.
What versions are affected by CVE-2025-8625?
CVE-2025-8625 affects versions 1.1 to 1.2 of the Copypress Rest API plugin.
What type of attacks can CVE-2025-8625 facilitate?
CVE-2025-8625 can facilitate remote code execution attacks due to improper handling of JWT signing keys.
Is there a workaround for CVE-2025-8625?
A temporary workaround for CVE-2025-8625 is to disable the Copypress Rest API plugin until it can be updated.