High · published January 7, 2026
⚡ Hold onto your WordPress sites! The WP Enable WebP plugin lets authenticated attackers upload any file they want, all thanks to a sneaky validation oversight! 🔥 Think of it like a trusted guest allowed to bring in anything they want into your house — without checking their bags! This vulnerability means that if an attacker has Author-level access, they can drop anything onto your server, including potentially harmful files. This could lead to devastating consequences, allowing attackers to execute arbitrary code on your server. Imagine them wandering through your digital house, changing things, or even deleting everything! Your entire site could be at risk and functioning in a compromised state.
Think of it like a trusted guest allowed to bring in anything they want into your house — without checking their bags! This vulnerability means that if an attacker has Author-level access, they can drop anything onto your server, including potentially harmful files. The vulnerability lies in the 'wpse_file_and_ext_webp' function of the WP Enable WebP plugin, which fails to properly validate file types. This allows attackers with sufficient user access to upload malicious files to the server.
This could lead to devastating consequences, allowing attackers to execute arbitrary code on your server. Imagine them wandering through your digital house, changing things, or even deleting everything! Your entire site could be at risk and functioning in a compromised state. Immediately update the WP Enable WebP plugin to the latest version to close this vulnerability. Review your user permissions to ensure only trusted individuals have Author-level access. Regularly audit your file uploads to catch any unauthorized entries! You've got this! With these steps, you’ll be on your way to securing your site like a pro! 🛡️