{
 "id": "WPSEC-2026-1253",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1253/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1253/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1253/index.md",
 "title": "WebP Express <= 0.25.15 - Unauthenticated Authentication Bypass in Web Service",
 "description": "The WebP Express plugin for WordPress is vulnerable to Authentication Bypass via the image conversion web service (web-service/wpc.php) in all versions up to, and including, 0.25.15, due to the API key check in the bundled webp-convert-cloud-service library not validating the supplied salt and using a loose comparison against the result of crypt(), which is an empty value when the salt is invalid. This makes it possible for unauthenticated attackers to use the site's conversion web service without knowing the API key, consuming server resources. Exploitation requires the web service to be enabled, which is not the default, and the attacker's IP to match a whitelist entry.",
 "plugin": {
  "slug": "webp-express",
  "name": "WebP Express",
  "full_name": "WebP Express",
  "wordpress_org": "https://wordpress.org/plugins/webp-express/",
  "advisories_url": "https://wpsec.com/vuln/plugin/webp-express/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/webp-express"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "0.25.16",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 0.25.16"
  ]
 },
 "introduced_in": null,
 "fixed_in": "0.25.16",
 "remediation": "Update to 0.25.16 or later.",
 "fix_released": "2026-10-18T11:33:21+00:00",
 "published": "2026-10-20T10:08:26+00:00",
 "updated": "2026-10-20T09:12:34.113345+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1253/",
  "https://plugins.svn.wordpress.org/webp-express/tags/0.25.16/",
  "https://wordpress.org/plugins/webp-express/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/webp-express",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-20"
 }
}