Arbitrary File Upload Vulnerability in Enable SVG, WebP, and ICO Upload Plugin for WordPress

CVE-2025-13069

What is CVE-2025-13069?

The Enable SVG, WebP, and ICO Upload plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation. This flaw permits authenticated users with author-level access or higher to upload malicious files, such as double extension files masquerading as valid ICO files. The vulnerability arises from the inability of the plugin to properly filter and validate the file types during the upload process. Exploiting this weakness may lead to remote code execution on the server, compromising the security of the affected WordPress site.

References