# WebP Express <= 0.25.15 - Unauthenticated Authentication Bypass in Web Service

- **ID:** WPSEC-2026-1253
- **Plugin:** WebP Express (`webp-express`), https://wordpress.org/plugins/webp-express/
- **Affected versions:** all versions before 0.25.16
- **Fixed in:** 0.25.16 (Update to 0.25.16 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-20)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/webp-express
- **Fix released:** 2026-10-18
- **Published:** 2026-10-20
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1253/

## Description

The WebP Express plugin for WordPress is vulnerable to Authentication Bypass via the image conversion web service (web-service/wpc.php) in all versions up to, and including, 0.25.15, due to the API key check in the bundled webp-convert-cloud-service library not validating the supplied salt and using a loose comparison against the result of crypt(), which is an empty value when the salt is invalid. This makes it possible for unauthenticated attackers to use the site's conversion web service without knowing the API key, consuming server resources. Exploitation requires the web service to be enabled, which is not the default, and the attacker's IP to match a whitelist entry.

## References

- https://wpsec.com/vuln/WPSEC-2026-1253/
- https://plugins.svn.wordpress.org/webp-express/tags/0.25.16/
- https://wordpress.org/plugins/webp-express/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1253/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.