CVE-2025-13069: WordPress SVG Plugin RCE Vulnerability

CVE-2025-13069 Overview

CVE-2025-13069 is an arbitrary file upload vulnerability in the Enable SVG, WebP, and ICO Upload plugin for WordPress. All versions up to and including 1.1.3 are affected. The plugin performs insufficient file type validation when detecting ICO files. Attackers can craft double-extension files containing valid ICO magic bytes to bypass sanitization while still being accepted as legitimate ICO uploads. Authenticated users with author-level access or higher can exploit this flaw to upload arbitrary files to the server. Successful exploitation may lead to remote code execution on the affected WordPress site. The issue is tracked under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers with author privileges can upload executable files and potentially achieve remote code execution on WordPress sites running the vulnerable plugin.

Affected Products

Enable SVG, WebP, and ICO Upload plugin for WordPress, versions <= 1.1.3
WordPress sites with author-level (or higher) accounts available to attackers
Web servers configured to execute PHP files within the WordPress uploads directory

Discovery Timeline

2025-11-18 - CVE-2025-13069 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13069

Vulnerability Analysis

The plugin extends WordPress media upload functionality to accept SVG, WebP, and ICO file types. To validate an uploaded ICO file, the plugin checks the file's magic bytes — the header signature identifying the file format. The validation logic confirms that the file begins with the expected ICO header but does not enforce a strict check on the file extension.

An attacker can craft a polyglot file with a double extension such as payload.ico.php. By prepending valid ICO magic bytes to a PHP payload, the file passes the magic byte check and is accepted as a valid ICO upload. The file is then written to the uploads directory with its original double extension intact.

When the web server processes the resulting file, it interprets it as PHP based on the trailing .php extension. This allows the attacker's payload to execute in the context of the web server, enabling remote code execution.

Root Cause

The root cause is incomplete file type validation. The plugin relies on magic byte inspection without verifying that the final file extension matches the declared content type. The combination of permissive extension handling and content-based validation creates a bypass condition.

Attack Vector

Exploitation requires an authenticated session with at least author-level privileges. The attacker authenticates to WordPress, then uses the media upload interface exposed by the plugin to submit a crafted file containing ICO magic bytes and a .php extension. Once uploaded, the attacker requests the file directly via its URL in the uploads directory to trigger PHP execution.

The vulnerability mechanics are described in the Wordfence Vulnerability Analysis and the WordPress Plugin Change Log.

Detection Methods for CVE-2025-13069

Indicators of Compromise

Files in wp-content/uploads/ with double extensions such as .ico.php, .ico.phtml, or .ico.phar
ICO files larger than expected or containing PHP tags (<?php) when inspected
Unexpected outbound network connections originating from the PHP-FPM or web server process
New or modified PHP files in the uploads directory that were not created by core WordPress functions

Detection Strategies

Scan the WordPress uploads directory for files whose extension does not match their MIME type or whose content includes PHP opening tags
Review WordPress audit logs for media uploads performed by author-level accounts using the plugin's upload handlers
Monitor web server access logs for direct HTTP requests to files within wp-content/uploads/ ending in .php or other executable extensions

Monitoring Recommendations

Alert on creation of executable files (.php, .phtml, .phar) anywhere under wp-content/uploads/
Track POST requests to admin-ajax.php and async-upload.php correlated with subsequent GET requests to newly created upload paths
Forward WordPress and web server logs to a centralized analytics platform for correlation across authentication, upload, and execution events

How to Mitigate CVE-2025-13069

Immediate Actions Required

Update the Enable SVG, WebP, and ICO Upload plugin to a version newer than 1.1.3 as soon as a fixed release is available
Audit all author, editor, and administrator accounts and revoke unused or untrusted access
Inspect the uploads directory for files with double extensions or embedded PHP code and remove confirmed malicious artifacts
Rotate WordPress credentials and secret keys if signs of compromise are present

Patch Information

Review the WordPress Plugin Change Log and the WordPress Plugin Page for the latest fixed release. Apply the patched version through the WordPress plugin updater or by replacing the plugin files manually after backing up the site.

Workarounds

Deactivate and remove the Enable SVG, WebP, and ICO Upload plugin until a patched version is installed
Configure the web server to deny PHP execution within wp-content/uploads/ using directives such as Apache <FilesMatch> blocks or nginx location rules
Restrict author-level accounts and require multi-factor authentication for all users with upload capability
Add server-side validation that rejects uploads with multiple extensions or extensions inconsistent with their MIME type

bash

# Example nginx configuration to block PHP execution in the uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php7|pht)$ {
    deny all;
    return 403;
}