CVE-2025-15158 is a vulnerability in the WP Enable WebP WordPress plugin caused by improper validation of uploaded file types in the 'wpse_file_and_ext_webp' function. Authenticated users with Author-level privileges or higher can exploit this to upload arbitrary files, potentially enabling remote code execution on the web server. This affects all plugin versions up to and including 1.0. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required at the Author level. No patch or official fix has been disclosed by the vendor as of the published date.

Successful exploitation allows an authenticated user with Author-level access or above to upload arbitrary files to the server hosting the WordPress site. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability has a high CVSS score of 8.8, reflecting significant potential impact. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling or removing the WP Enable WebP plugin if possible. Monitor for updates from eastsidecode regarding patches or official mitigations.