Critical · published September 30, 2025
🚨 A hard-coded fallback means attackers can easily forge a valid token and upload malicious files! This sneaky flaw in the Copypress Rest API plugin for WordPress lets anyone without authentication execute code remotely. 🔥 Think of it like a delivery driver who doesn't check that the package is for the right address, happily dropping off anything addressed to anyone — including dangerous items that could wreak havoc. 📦🎭 An attacker could run arbitrary PHP scripts on your server, essentially gaining full control over your WordPress site! This means they could steal sensitive information, modify content, or even take down the entire site, leading to absolutely devastating consequences for your online presence.
Think of it like a delivery driver who doesn't check that the package is for the right address, happily dropping off anything addressed to anyone — including dangerous items that could wreak havoc. 📦🎭 The vulnerability in the Copypress Rest API plugin (versions 1.1 to 1.2) allows unauthenticated users to exploit the copyreap_handle_image() function, where a hard-coded JWT signing key is used when no secret is defined. This oversight allows attackers to bypass authentication and upload malicious files at will.
An attacker could run arbitrary PHP scripts on your server, essentially gaining full control over your WordPress site! This means they could steal sensitive information, modify content, or even take down the entire site, leading to absolutely devastating consequences for your online presence. Immediate action is crucial! Update the Copypress Rest API plugin to version 1.3 or later to patch this vulnerability. Additionally, review your settings to ensure that only trusted file types can be uploaded. 🛡️ You've got this! Follow these steps and you'll lock down your site in no time! 🦸♂️💪