See how copypress compares to other vendors in security performance
The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreaphandleimage() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file types can be fetched and saved as attachments. As a result, unauthenticated attackers can forge a valid token to gain elevated privileges and upload an arbitrary file (e.g. a PHP script) through the image handler, leading to remote code execution.
Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.