Arbitrary File Upload Vulnerability in Enable SVG, WebP, and ICO Upload Plugin for WordPress
CVE-2025-13069

8.8HIGH

Key Information:

Vendor

WordPress
Status
Enable Svg, Webp, And Ico Upload
Vendor
CVE Published:
18 November 2025

What is CVE-2025-13069?

The Enable SVG, WebP, and ICO Upload plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation. This flaw permits authenticated users with author-level access or higher to upload malicious files, such as double extension files masquerading as valid ICO files. The vulnerability arises from the inability of the plugin to properly filter and validate the file types during the upload process. Exploiting this weakness may lead to remote code execution on the server, compromising the security of the affected WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Enable SVG, WebP, and ICO Upload * <= 1.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/enable-svg-webp-ico-upload/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Mazzolini
JSON
.