Copypress Rest API WordPress Plugin CVE-2025-8625: Brief Summary of Critical Remote Code Execution Vulnerability

Introduction

Attackers can execute code remotely, without authentication, on WordPress sites running vulnerable versions of the Copypress Rest API plugin. They can upload and execute arbitrary files, including PHP scripts, which may lead to full compromise of the affected site.

Copypress Rest API is a WordPress plugin that extends REST API capabilities for content management. It is not one of the largest plugins in the ecosystem, but it does run on production sites, and this flaw shows the risk that third-party extensions carry. The WordPress Plugin Review Team temporarily closed the plugin on September 26, 2025, after the flaw was discovered.

Technical information

CVE-2025-8625 combines two separate security failures in Copypress Rest API plugin versions 1.1 to 1.2:

1. Hard-coded JWT signing key: The plugin uses JWT for authentication. If no secret is configured, it falls back to a signing key hard-coded in the plugin. That key is public because it ships in the source, so anyone who reads it can forge valid JWT tokens for any site running the plugin with default settings. A forged token bypasses authentication and gives the attacker access to protected API endpoints.

2. Missing file type validation in copyreap_handle_image(): The plugin's image handler does not restrict which file types can be uploaded and saved as attachments. Attackers can therefore upload arbitrary files, including PHP scripts, through the API endpoint. The uploaded files are stored where the web server can reach them, which allows direct execution.

Attack flow:

1. The attacker forges a valid JWT token with the hard-coded signing key.
2. The attacker sends a request to the vulnerable image handler endpoint and uploads a malicious file, such as a PHP webshell.
3. The plugin saves the file without validating it.
4. The attacker requests the uploaded file through the web server and gets remote code execution.

Root cause:

• A hard-coded cryptographic key for JWT signing (CWE-321).
• No file type or content validation in the file upload logic.

At the time of writing, no advisory or published research includes code snippets.

Affected systems and versions

• Product: Copypress Rest API WordPress plugin
• Affected versions: 1.1 to 1.2
• Every configuration running these versions is vulnerable, especially one where the JWT secret is not explicitly set.

Vendor security history

• The WordPress Plugin Review Team closed the plugin on September 26, 2025, because of this vulnerability.
• No public record of earlier vulnerabilities or security incidents involving this plugin or its vendor was found.

References

• NVD CVE-2025-8625
• WordPress Plugin Directory: Copypress Rest API
• Wordfence Threat Intelligence: CVE-2025-8625
• Wordfence Vulnerability Advisory