CVE-2025-13069

High

Published: 18 November 2025

Published

18 November 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 23.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13069 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the insufficient file type validation flaw by requiring comprehensive checks on uploaded files to block double extensions and magic byte bypasses.

SI-2 Flaw Remediation good match

prevent

Ensures timely patching of the vulnerable WordPress plugin versions up to 1.1.3 to remediate the arbitrary file upload vulnerability.

CM-11 User-installed Software good match

prevent

Prevents deployment of unapproved user-installed software like the vulnerable Enable SVG, WebP, and ICO Upload plugin.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Arbitrary file upload vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing web application (T1190), allowing remote code execution via crafted file uploads.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to insufficient file type validation detecting ICO files, allowing double extension files with…

the appropriate magic bytes to bypass sanitization while being accepted as a valid ICO file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Deeper analysisAI

CVE-2025-13069 is an arbitrary file upload vulnerability in the Enable SVG, WebP, and ICO Upload plugin for WordPress, affecting all versions up to and including 1.1.3. The flaw stems from insufficient file type validation when handling ICO files, which allows attackers to use double extension files containing the appropriate magic bytes. This bypasses sanitization checks, as the files are accepted as valid ICOs. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).

Authenticated attackers with author-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. By uploading crafted files through the plugin's media upload functionality, they can place arbitrary files on the affected WordPress site's server. This capability may enable remote code execution, depending on server permissions and configuration, potentially leading to full site compromise.

Mitigation details are available in advisories from Wordfence and the plugin's official page, with a specific patch applied in WordPress trac changeset 3411477 for the enable-svg-webp-ico-upload repository. Security practitioners should urge site administrators to update the plugin beyond version 1.1.3 and review uploaded media for malicious files.