PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm

CVE-2025-29927 is a critical (CVSS 9.1) authorization bypass in Vercel's Next.js, a widely used React framework for full-stack web applications: when an application performs its authorization checks in middleware, a remote unauthenticated attacker can bypass those checks by sending a request containing the x-middleware-subrequest header, which causes the middleware to be skipped. Successful exploitation grants access to otherwise protected routes and resources without valid credentials, with high impact on confidentiality and integrity and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). All Next.js releases starting in version 1.11.4 and prior to the branch-specific fixed versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3 are affected, so any Next.js application that relies on middleware for authorization is exposed. Exploitation is not yet confirmed in the provided data: the flaw is not in CISA KEV and no public proof-of-concept is catalogued, but EPSS assigns a 99.2% (100th percentile) probability of exploitation within 30 days, and national authorities such as the UK NCSC are urging immediate patching.

Do: Upgrade Next.js to 12.3.5, 13.5.9, 14.2.25, or 15.2.3, matching your application's release branch. If patching is infeasible, block or strip the x-middleware-subrequest header from external requests at the reverse proxy, CDN, or WAF before they reach the Next.js application. Audit whether your applications perform authorization checks in middleware, and verify that protected routes cannot be reached without authentication after remediation.

CWP (Control Web Panel, also known as CentOS Web Panel) versions before 0.9.8.1205 contain an unauthenticated OS command injection flaw (CWE-78): shell metacharacters supplied in the t_total parameter of a filemanager changePerm request are passed to a shell and executed by the server. The only precondition is knowing a valid non-root username on the target, which raises attack complexity but can be trivially met through exposed or common account names. Successful exploitation yields remote code execution on the hosting server, and the scope-changed CVSS metric (S:C with C:H/I:H/A:H) indicates impact beyond the vulnerable component. Any CWP installation running a version earlier than 0.9.8.1205 is affected — typically internet-facing CentOS/RHEL/AlmaLinux servers run by small hosting providers, resellers, and administrators. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-04, a public proof of concept is available, and EPSS assigns a 99.7% probability of exploitation within 30 days.

Do: Upgrade to CWP 0.9.8.1205 or later using the panel's built-in update process, as required by CISA's KEV/BOD 22-01 guidance; until patched, restrict access to the CWP admin ports (2030/2031) to trusted IPs or a VPN and limit exposed usernames, since the attacker must know a valid non-root user. Review logs for filemanager changePerm requests containing metacharacters in the t_total parameter to detect exploitation attempts, and check for signs of post-exploitation such as unexpected processes, cron entries, or web shells.

CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell.

Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials.

CVE-2025-9501 is an unauthenticated command injection flaw in the W3 Total Cache WordPress plugin, located in the _parse_dynamic_mfunc function and affecting all versions before 2.8.13. An attacker triggers it by submitting a comment containing a crafted payload to a post on a site running the plugin, causing the injected PHP commands to be parsed and executed; the CVSS high attack complexity (AC:H) indicates certain site conditions must align for exploitation to succeed. Successful exploitation grants arbitrary PHP code/command execution on the web server, and the changed scope in the CVSS vector (S:C) means impact can extend beyond the plugin to the broader hosting environment with high confidentiality, integrity, and availability impact. Any WordPress site running W3 Total Cache prior to 2.8.13 is affected, regardless of the visitor's privileges since the attack requires no authentication and no user interaction. There is currently no known public PoC, the flaw is not in CISA KEV, but EPSS puts the probability of exploitation within 30 days at 20.5% (97th percentile), signaling elevated near-term risk.

Do: Upgrade W3 Total Cache to version 2.8.13 or later on all affected sites. As an interim mitigation, restrict or moderate comment submission on cached posts (or temporarily disable the plugin) and review recent comments for crafted payloads containing PHP/mfunc-style tags. Although there is no public PoC or KEV listing yet, the elevated EPSS (20.5%, 97th percentile) justifies prioritized patching.

Migration, Backup, Staging - WPvivid Backup & Migration, a WordPress backup and migration plugin, is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to and including 0.9.123. The flaw combines two errors in the plugin's encrypted transfer feature: when RSA decryption of a session key fails via openssl_private_decrypt(), the plugin continues anyway, and the phpseclib AES library treats the returned boolean 'false' as a key made of null bytes, letting attackers forge properly encrypted payloads with a predictable key. Because filenames taken from the decrypted payload are never sanitized, directory traversal lets an attacker write PHP files outside the protected backup directory into publicly accessible folders, all triggered by an unauthenticated request containing the wpvivid_action=send_to_site parameter. Any WordPress site running the plugin at version 0.9.123 or earlier is affected, with no authentication or user interaction required, consistent with the maximum-range 9.8 CVSS score. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the EPSS score of 32.7% (98th percentile) implies roughly a one-in-three chance of exploitation within 30 days.

Do: Upgrade WPvivid Backup & Migration to a release newer than 0.9.123 on every site where it is installed as soon as a patched version is available. Until patched, block or restrict unauthenticated requests containing wpvivid_action=send_to_site (e.g., via WAF rules) and check web-accessible directories for unexpectedly created PHP files. Although no exploitation is confirmed yet, the high EPSS score (~33% within 30 days) warrants urgent patching.