CVE-2025-13516: WordPress SureMail Plugin RCE Vulnerability

CVE-2025-13516 Overview

CVE-2025-13516 is a high-severity Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) affecting the SureMail – SMTP and Email Logs Plugin for WordPress in versions up to and including 1.9.0. The vulnerability exists in the plugin's save_file() function located in inc/emails/handler/uploads.php, which duplicates all email attachments to a web-accessible directory without validating file extensions or content types.

This critical flaw enables unauthenticated attackers to achieve Remote Code Execution (RCE) by uploading malicious PHP files through any public form that emails attachments, calculating the predictable filename based on MD5 hashes, and directly accessing the file to execute arbitrary code on vulnerable web server configurations.

Critical Impact
Unauthenticated Remote Code Execution via malicious file upload allowing complete server compromise on affected web server configurations (nginx, IIS, Lighttpd, or misconfigured Apache installations).

Affected Products

SureMail – SMTP and Email Logs Plugin for WordPress versions up to and including 1.9.0
WordPress installations running nginx web server
WordPress installations running IIS or Lighttpd web servers
WordPress installations with misconfigured Apache (bypassing .htaccess protections)

Discovery Timeline

2025-12-02 - CVE-2025-13516 published to NVD
2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-13516

Vulnerability Analysis

The vulnerability carries a CVSS 3.1 score of 8.1 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates a network-exploitable vulnerability requiring no privileges or user interaction, with high impacts to confidentiality, integrity, and availability. The attack complexity is rated as High due to the server configuration requirements.

According to EPSS (Exploit Prediction Scoring System) data from 2025-12-16, this vulnerability has a probability score of 0.259%, placing it in the 49th percentile of exploitability predictions.

The vulnerable function save_file() in inc/emails/handler/uploads.php processes email attachments and stores them in the wp-content/uploads/suremails/attachments/ directory. This directory is web-accessible, and files are saved with predictable names derived from MD5 hashes of their content, making it trivial for attackers to calculate the resulting filename and access the uploaded malicious file directly.

Root Cause

The root cause of this vulnerability is the lack of file validation in the save_file() function. The plugin fails to:

Validate file extensions - No whitelist or blacklist filtering of dangerous file types (e.g., .php, .phtml, .phar)
Verify content types - No MIME type validation or content inspection
Implement proper access controls - Files are stored in a publicly accessible directory

While the plugin attempts to mitigate execution risk by placing an Apache .htaccess file in the uploads directory to disable PHP execution, this protection mechanism is fundamentally flawed as it only works on properly configured Apache web servers. The protection is completely ineffective on nginx, IIS, and Lighttpd servers, which do not honor .htaccess directives.

Attack Vector

The attack vector is network-based and can be exploited by unauthenticated attackers through the following sequence:

Identify a target - Locate a WordPress site using the vulnerable SureMail plugin running on nginx, IIS, Lighttpd, or a misconfigured Apache server
Locate a public form - Find any contact form or submission mechanism that emails attachments
Upload malicious payload - Submit a form with a malicious PHP file as an attachment
Calculate filename - Compute the MD5 hash of the file content to determine the predictable filename
Access and execute - Navigate directly to wp-content/uploads/suremails/attachments/[calculated_filename].php to execute arbitrary code

The vulnerability is particularly dangerous because it can be triggered through legitimate site functionality (contact forms) without requiring any authentication, and the file naming scheme based on content MD5 hashes makes the resulting filename entirely predictable to an attacker who controls the file content.

Detection Methods for CVE-2025-13516

Indicators of Compromise

Unexpected PHP files appearing in wp-content/uploads/suremails/attachments/ directory
HTTP requests to the wp-content/uploads/suremails/attachments/ path attempting to execute PHP files
Web server logs showing direct access to files with PHP extensions in the suremails attachments directory
Unusual POST requests to contact forms containing file attachments with suspicious extensions
Evidence of web shells or backdoor files with MD5-hash-based filenames

Detection Strategies

File System Monitoring:
Monitor the wp-content/uploads/suremails/attachments/ directory for the creation of files with executable extensions such as .php, .phtml, .phar, or other server-side script extensions. Any PHP files in this directory should be considered highly suspicious.

Web Application Firewall (WAF) Rules:
Implement WAF rules to block direct access to the suremails attachments directory for requests targeting executable file types. Additionally, inspect form submissions for attachments containing PHP code signatures.

Log Analysis:
Review web server access logs for:

200 OK responses to requests for PHP files in the uploads/suremails/attachments path
Unusual form submissions with file attachments from unknown or suspicious IP addresses
Sequential requests pattern: form submission followed by direct file access

Monitoring Recommendations

Organizations should implement real-time monitoring for file creation events in WordPress upload directories, particularly watching for executable file types. Security teams should also monitor for anomalous web traffic patterns indicating reconnaissance or exploitation attempts, such as directory enumeration or repeated access attempts to the suremails uploads path.

SentinelOne Singularity provides comprehensive endpoint protection that can detect and prevent malicious file execution, web shell deployment, and post-exploitation activities associated with this type of vulnerability. The platform's behavioral AI engine can identify suspicious PHP process spawning and anomalous file system operations characteristic of RCE exploitation.

How to Mitigate CVE-2025-13516

Immediate Actions Required

Update immediately - Upgrade the SureMail plugin to a version newer than 1.9.0 that includes the security patch
Audit uploads directory - Review all files in wp-content/uploads/suremails/attachments/ for suspicious or unexpected PHP files
Implement web server hardening - Configure nginx, IIS, or Lighttpd to deny PHP execution in upload directories
Review server logs - Check for evidence of exploitation attempts or successful compromises
Consider temporary deactivation - If unable to patch immediately, consider disabling the SureMail plugin until updates can be applied

Patch Information

A security patch is available through the WordPress plugin repository. The fix can be found in changeset 3403145 which addresses the unrestricted file upload vulnerability.

Additional technical details about the vulnerability are available from Wordfence.

Workarounds

If immediate patching is not possible, administrators can implement server-level mitigations to prevent PHP execution in the vulnerable uploads directory.

For nginx servers, add the following to your server configuration:

nginx

# Block PHP execution in SureMail uploads directory
location ~* /wp-content/uploads/suremails/attachments/.*\.php$ {
    deny all;
    return 403;
}

For IIS servers, create a web.config file in the uploads directory:

xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <handlers accessPolicy="Read" />
    </system.webServer>
</configuration>

For Apache servers, verify that .htaccess processing is enabled and the existing protections are functioning correctly. These workarounds should be considered temporary measures until the plugin can be updated to a patched version.