CVE-2025-8895 describes an arbitrary file access vulnerability affecting the WP Webhooks plugin for WordPress. This vulnerability allows unauthenticated attackers to copy arbitrary files from the server, potentially leading to sensitive data exposure. Versions of the plugin up to and including 3.3.5 are affected, and a fix is available in version 3.3.6.
检测此 CVE 是否影响你的项目
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
影响与攻击场景翻译中…
The primary impact of CVE-2025-8895 is the potential for unauthorized access to sensitive files on the WordPress server. An attacker can exploit this vulnerability to copy files to arbitrary locations, including the critical wp-config.php file. This file contains database credentials, allowing the attacker to gain complete control over the WordPress database. Successful exploitation could lead to data breaches, website defacement, and complete compromise of the WordPress installation. The lack of authentication required for exploitation significantly broadens the attack surface, making this a high-risk vulnerability.
利用背景翻译中…
CVE-2025-8895 was publicly disclosed on 2025-08-21. There is currently no indication of active exploitation campaigns, but the ease of exploitation and the potential impact make it a high-priority vulnerability. No public proof-of-concept (PoC) code has been released as of this writing, but the vulnerability is straightforward to exploit, increasing the likelihood of PoC development. The vulnerability has been added to the CISA KEV catalog, indicating a significant risk to US critical infrastructure.
哪些人处于风险中翻译中…
Websites using the WP Webhooks plugin, particularly those with default WordPress configurations and limited server access controls, are at significant risk. Shared hosting environments are especially vulnerable, as attackers may be able to exploit this vulnerability to access files on other users' websites.
检测步骤翻译中…
• wordpress / composer / npm:
wp plugin list | grep wp-webhooks• wordpress / composer / npm:
wp plugin update wp-webhooks --version=3.3.6• wordpress / composer / npm:
find /var/www/html/wp-content/plugins/wp-webhooks/ -type f -name '*.php' -exec grep -i 'copy(' {} +)• generic web: Check WordPress plugin directory for unauthorized file copies. Monitor web server access logs for unusual file access patterns targeting the WP Webhooks plugin directory.
攻击时间线
- Disclosure
disclosure
- Patch
patch
- CISA KEV
kev
威胁情报
漏洞利用状态
EPSS
0.28% (51% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 无 — 无需认证，无需凭证即可利用。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 高 — 攻击者可写入、修改或删除任何数据。
- Availability
- 高 — 完全崩溃或资源耗尽，完全拒绝服务。
受影响的软件
软件包信息
- 活跃安装数
- 20K小众
- 插件评分
- 4.6
- 需要WordPress版本
- 4.7+
- 兼容至
- 7.0
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2025-8895 is to immediately upgrade the WP Webhooks plugin to version 3.3.6 or later. If upgrading is not immediately possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. While no direct WAF rules can prevent the underlying vulnerability, restricting file access permissions on the server can limit the damage if exploitation occurs. Specifically, ensure the web server user has minimal write access outside of the designated WordPress directories. After upgrading, verify the fix by attempting to access a non-public file via a crafted URL; access should be denied.
修复方法
将 WP Webhooks 插件更新到 3.3.6 或更高版本以缓解任意文件复制漏洞。 此更新修复了允许未经身份验证的攻击者复制服务器文件的用户输入验证不足的问题。 在更新之前，请务必备份您的站点。
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2025-8895 — Arbitrary File Access in WP Webhooks?
CVE-2025-8895 is a critical vulnerability in the WP Webhooks WordPress plugin allowing unauthenticated attackers to copy arbitrary files, potentially exposing sensitive data like database credentials.
Am I affected by CVE-2025-8895 in WP Webhooks?
You are affected if you are using WP Webhooks version 0.0.0 through 3.3.5. Immediately check your plugin version and upgrade if necessary.
How do I fix CVE-2025-8895 in WP Webhooks?
Upgrade the WP Webhooks plugin to version 3.3.6 or later. If immediate upgrade is not possible, implement temporary server access restrictions.
Is CVE-2025-8895 being actively exploited?
While no active exploitation campaigns have been confirmed, the vulnerability's ease of exploitation makes it a high-priority risk.
Where can I find the official WP Webhooks advisory for CVE-2025-8895?
Refer to the official WP Webhooks website and WordPress security announcements for the latest information and advisory regarding CVE-2025-8895.