Introduction
An attacker with no credentials can get remote code execution on a WordPress site running BerqWP by uploading a malicious file. BerqWP is a widely used performance optimization plugin, so many production websites are at risk of full compromise until they patch.
BerqWP is an all-in-one WordPress plugin for automated page speed optimization. It bundles caching, CDN, image, CSS, and JavaScript optimization, and a substantial number of WordPress sites use it to improve Core Web Vitals and overall performance. That reach, along with the plugin's place in each site's performance workflow, makes a flaw in its code especially costly for the WordPress ecosystem.
Technical Information
CVE-2025-7443 is an arbitrary file upload vulnerability in the store_javascript_cache.php endpoint of the BerqWP plugin. The endpoint exists to cache JavaScript files as part of the plugin's optimization process, but it does no file type validation at all. Attackers can upload files of any type to the server, including executable scripts.
The root cause is that the upload logic checks neither file extensions nor MIME types. An unauthenticated attacker can send a crafted HTTP POST request to the endpoint with a malicious file in the payload, such as a PHP web shell. The plugin stores the uploaded file in a web-accessible directory, so the attacker can then request and execute it remotely, which gives them arbitrary code execution on the server.
The issue is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). It affects all plugin installations up to and including version 2.2.42. With no authentication and no restriction on what can be uploaded, exploitation is trivial and the impact is high.
Relevant code and endpoint references:
Affected Systems and Versions
- Product: BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript (WordPress plugin)
- Affected versions: All versions up to and including 2.2.42
- Vulnerable endpoint:
store_javascript_cache.php - Authentication required for exploitation: none
Vendor Security History
- An earlier arbitrary file upload vulnerability in BerqWP version 1.7.6 (Wordfence advisory)
- Recurring problems with file upload handling and input validation
- Actively developed, with multiple security flaws over time
