CVE-2025-8889
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Compress & Upload WordPress plugin before version 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup).
Risk Assessment
The risk involves the possibility of uploading malicious files (e.g., PHP scripts) by an admin, which could lead to server compromise or attack escalation in a multisite environment.
Recommendation
It is recommended to immediately update the Compress & Upload plugin to version 1.0.5 or later, which includes the file validation fix.
Original NVD description (English source)
The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)