CVE-2025-13069
Published: 18 November 2025
Summary
CVE-2025-13069 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-13069 is an arbitrary file upload vulnerability in the Enable SVG, WebP, and ICO Upload plugin for WordPress, affecting all versions up to and including 1.1.3. The flaw stems from insufficient file type validation when handling ICO files, which allows attackers to use double extension files containing the appropriate magic bytes. This bypasses sanitization checks, as the files are accepted as valid ICOs. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with author-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. By uploading crafted files through the plugin's media upload functionality, they can place arbitrary files on the affected WordPress site's server. This capability may enable remote code execution, depending on server permissions and configuration, potentially leading to full site compromise.
Mitigation details are available in advisories from Wordfence and the plugin's official page, with a specific patch applied in WordPress trac changeset 3411477 for the enable-svg-webp-ico-upload repository. Security practitioners should urge site administrators to update the plugin beyond version 1.1.3 and review uploaded media for malicious files.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-197965
Vulnerability details
The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to insufficient file type validation detecting ICO files, allowing double extension files with…
more
the appropriate magic bytes to bypass sanitization while being accepted as a valid ICO file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing web application (T1190), allowing remote code execution via crafted file uploads.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient file type validation flaw by requiring comprehensive checks on uploaded files to block double extensions and magic byte bypasses.
Ensures timely patching of the vulnerable WordPress plugin versions up to 1.1.3 to remediate the arbitrary file upload vulnerability.
Prevents deployment of unapproved user-installed software like the vulnerable Enable SVG, WebP, and ICO Upload plugin.