CVE-2025-15158

CVE-2025-15158 is a WordPress WP Enable WebP vulnerability. The Wordfence entry confirms an authenticated arbitrary file upload due to improper file-type validation in wpse_file_and_ext_webp, affecting WP Enable WebP

CVE-2025-15158: Unrestricted Upload of File with Dangerous Type

The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpsefileandextwebp' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

PT-2026-1600

Name of the Vulnerable Software and Affected Versions WP Enable WebP versions up to and including 1.0 Description The WP Enable WebP plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation within the wpse file and ext webp function. This allows...