WebP Express <= 0.25.15 - Unauthenticated Authentication Bypass in Web Service
- ID
- WPSEC-2026-1253
- Plugin
- WebP Express (webp-express)
- Affected
- all versions before 0.25.16
- Remediation
- Update to 0.25.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-20
- Attack surface
- WebP Express on WPSec AttackSurface
- Fix released
- Published
Description
The WebP Express plugin for WordPress is vulnerable to Authentication Bypass via the image conversion web service (web-service/wpc.php) in all versions up to, and including, 0.25.15, due to the API key check in the bundled webp-convert-cloud-service library not validating the supplied salt and using a loose comparison against the result of crypt(), which is an empty value when the salt is invalid. This makes it possible for unauthenticated attackers to use the site's conversion web service without knowing the API key, consuming server resources. Exploitation requires the web service to be enabled, which is not the default, and the attacker's IP to match a whitelist entry.
References
- https://wpsec.com/vuln/WPSEC-2026-1253/
- https://plugins.svn.wordpress.org/webp-express/tags/0.25.16/
- https://wordpress.org/plugins/webp-express/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS