CVE-2025-66074 CRITICAL

CVE-2025-66074: WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability

Vendor Cozmoslabs
Product WP Webhooks
Weakness CWE-434 · Unrestricted file upload
Published December 18, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.0/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from n/a through <= 3.3.8.

Explanation of Vulnerability in Simple Terms

02Summary

WP Webhooks versions 3.3.8 and earlier allow unauthenticated attackers to upload arbitrary files to the site through a network request. The vulnerability requires specific conditions to exploit but can result in complete compromise of the site, including data theft, modification, and service disruption. Site administrators should update immediately to a patched version.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files to the site without authentication, potentially leading to code execution and full site compromise.

Potential impact on your site

04Site Impact

Attackers can upload malicious files, run code on your site, steal data, modify content, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required, though exploitation may depend on specific server configuration.

Key dates

06Disclosure timeline

December 18, 2025 CVE published
April 28, 2026 Record updated