PT-2025-47285 · WordPress · Enable Svg

Michael Mazzolini · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-13069

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enable SVG, WebP, and ICO Upload plugin for WordPress versions up to and including 1.1.2

Description The Enable SVG, WebP, and ICO Upload plugin for WordPress is susceptible to arbitrary file upload due to insufficient file type validation when handling ICO files. This allows attackers to bypass sanitization by using double extensions and appropriate magic bytes, potentially enabling the upload of malicious files. Successful exploitation could lead to remote code execution on the affected server. The issue affects authenticated attackers with author-level access or higher.

Recommendations Update the Enable SVG, WebP, and ICO Upload plugin to a version later than 1.1.2.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-13069

Affected Products

Enable Svg

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13069 · Security Note
• https://twitter.com/CveFindCom/status/1990883277033414820 · Twitter Post
• https://t.me/cveNotify/143176 · Telegram Post
• https://t.me/CVEtracker/37594 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5716c4e1-a6d3-42e8-b90c-d16f204c8503?source=cve · Note
• https://twitter.com/CveTodo/status/1990731455211733493 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3411477%40enable-svg-webp-ico-upload&new=3411477%40enable-svg-webp-ico-upload&sfp_email=&sfph_mail= · Note
• https://twitter.com/VulmonFeeds/status/1990815607613231414 · Twitter Post
• https://wordpress.org/plugins/enable-svg-webp-ico-upload · Note
• https://twitter.com/CVEnew/status/1990717534648054009 · Twitter Post