プラットフォーム
wordpress
コンポーネント
wp-webhooks
修正版
3.3.6
CVE-2025-8895 describes an arbitrary file access vulnerability affecting the WP Webhooks plugin for WordPress. This vulnerability allows unauthenticated attackers to copy arbitrary files from the server, potentially leading to sensitive data exposure. Versions of the plugin up to and including 3.3.5 are affected, and a fix is available in version 3.3.6.
The primary impact of CVE-2025-8895 is the potential for unauthorized access to sensitive files on the WordPress server. An attacker can exploit this vulnerability to copy files to arbitrary locations, including the critical wp-config.php file. This file contains database credentials, allowing the attacker to gain complete control over the WordPress database. Successful exploitation could lead to data breaches, website defacement, and complete compromise of the WordPress installation. The lack of authentication required for exploitation significantly broadens the attack surface, making this a high-risk vulnerability.
CVE-2025-8895 was publicly disclosed on 2025-08-21. There is currently no indication of active exploitation campaigns, but the ease of exploitation and the potential impact make it a high-priority vulnerability. No public proof-of-concept (PoC) code has been released as of this writing, but the vulnerability is straightforward to exploit, increasing the likelihood of PoC development. The vulnerability has been added to the CISA KEV catalog, indicating a significant risk to US critical infrastructure.
Websites using the WP Webhooks plugin, particularly those with default WordPress configurations and limited server access controls, are at significant risk. Shared hosting environments are especially vulnerable, as attackers may be able to exploit this vulnerability to access files on other users' websites.
• wordpress / composer / npm:
wp plugin list | grep wp-webhooks• wordpress / composer / npm:
wp plugin update wp-webhooks --version=3.3.6• wordpress / composer / npm:
find /var/www/html/wp-content/plugins/wp-webhooks/ -type f -name '*.php' -exec grep -i 'copy(' {} +)• generic web: Check WordPress plugin directory for unauthorized file copies. Monitor web server access logs for unusual file access patterns targeting the WP Webhooks plugin directory.
disclosure
patch
kev
エクスプロイト状況
EPSS
0.28% (51% パーセンタイル)
CISA SSVC
CVSS ベクトル
The primary mitigation for CVE-2025-8895 is to immediately upgrade the WP Webhooks plugin to version 3.3.6 or later. If upgrading is not immediately possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. While no direct WAF rules can prevent the underlying vulnerability, restricting file access permissions on the server can limit the damage if exploitation occurs. Specifically, ensure the web server user has minimal write access outside of the designated WordPress directories. After upgrading, verify the fix by attempting to access a non-public file via a crafted URL; access should be denied.
WP Webhooksプラグインをバージョン3.3.6以降にアップデートすることで、任意のファイルコピーの脆弱性を軽減できます。このアップデートは、認証されていない攻撃者がファイルをコピーすることを可能にするユーザー入力の検証不足を修正します。アップデートする前に、サイトのバックアップを作成するようにしてください。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2025-8895 is a critical vulnerability in the WP Webhooks WordPress plugin allowing unauthenticated attackers to copy arbitrary files, potentially exposing sensitive data like database credentials.
You are affected if you are using WP Webhooks version 0.0.0 through 3.3.5. Immediately check your plugin version and upgrade if necessary.
Upgrade the WP Webhooks plugin to version 3.3.6 or later. If immediate upgrade is not possible, implement temporary server access restrictions.
While no active exploitation campaigns have been confirmed, the vulnerability's ease of exploitation makes it a high-priority risk.
Refer to the official WP Webhooks website and WordPress security announcements for the latest information and advisory regarding CVE-2025-8895.
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。