CVE-2025-7443
📋 TL;DR
The BerqWP WordPress plugin has an unauthenticated arbitrary file upload vulnerability that allows attackers to upload malicious files to the server. This affects all versions up to 2.2.42 and can lead to remote code execution. Any WordPress site using the vulnerable plugin is at risk.
💻 Affected Systems
- BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through remote code execution, leading to data theft, defacement, or ransomware deployment.
Likely Case
Attackers upload web shells to gain persistent access, install malware, or pivot to other systems.
If Mitigated
Limited impact if file uploads are restricted by web server permissions or security plugins block malicious requests.
🎯 Exploit Status
Exploitation requires sending a crafted request to store_javascript_cache.php. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.43 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3330075/searchpro/trunk/api/register_apis.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find BerqWP plugin. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable vulnerable endpoint via .htaccess
linuxBlock access to the vulnerable PHP file using web server rules.
<Files "store_javascript_cache.php">
Order Allow,Deny
Deny from all
</Files>
Temporarily disable plugin
allDeactivate the BerqWP plugin until patched.
wp plugin deactivate berqwp
🧯 If You Can't Patch
- Disable the BerqWP plugin immediately.
- Implement web application firewall (WAF) rules to block requests to store_javascript_cache.php.
🔍 How to Verify
Check if Vulnerable:
Check if /wp-content/plugins/berqwp/api/store_javascript_cache.php exists and plugin version is ≤2.2.42.Check Version:
wp plugin get berqwp --field=versionVerify Fix Applied:
Confirm plugin version is 2.2.43+ and store_javascript_cache.php has proper file validation.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-content/plugins/berqwp/api/store_javascript_cache.php
- Uploads of unusual file types (e.g., .php, .phtml) via that endpoint
Network Indicators:
- Unusual outbound connections from web server after file upload
SIEM Query:
source="web_logs" AND uri="/wp-content/plugins/berqwp/api/store_javascript_cache.php" AND method="POST"