Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution
Strategic Overview
- Status
- Patched in 1.3
- Affected Plugin
- Copypress Rest API
- Affected Version
1.1 – 1.2- CVSS
- 9.8Critical
- Weakness type
- CWE-321 · Use of Hard-coded Cryptographic Key
- CVE
CVE-2025-8625
At a glance
CVE-2025-8625 is a critical-severity Use of Hard-coded Cryptographic Key vulnerability in the Copypress Rest API WordPress plugin, affecting versions 1.1 – 1.2. It carries a CVSS score of 9.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires no authentication. The issue is fixed in version 1.3; sites on affected versions should update now. Disclosed September 2025, reported by kr0d.
Vulnerability Overview
The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file types can be fetched and saved as attachments. As a result, unauthenticated attackers can forge a valid token to gain elevated privileges and upload an arbitrary file (e.g. a PHP script) through the image handler, leading to remote code execution.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-321: Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key.
Remediation
Update to version 1.3, or a newer patched version
How does WordSec protect against this?
This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Copypress Rest API 1.3 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C