CVE-2025-13069
Published: 18 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-13069 is an arbitrary file upload vulnerability in the Enable SVG, WebP, and ICO Upload plugin for WordPress, affecting all versions up to and including 1.1.3. The flaw stems from insufficient file type validation when handling ICO files, which allows attackers to use double extension files containing the appropriate magic bytes. This bypasses sanitization checks, as the files are accepted as valid ICOs. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with author-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. By uploading crafted files through the plugin's media upload functionality, they can place arbitrary files on the affected WordPress site's server. This capability may enable remote code execution, depending on server permissions and configuration, potentially leading to full site compromise.
Mitigation details are available in advisories from Wordfence and the plugin's official page, with a specific patch applied in WordPress trac changeset 3411477 for the enable-svg-webp-ico-upload repository. Security practitioners should urge site administrators to update the plugin beyond version 1.1.3 and review uploaded media for malicious files.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing web application (T1190), allowing remote code execution via crafted file uploads.