CVE-2025-13516
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wordpress | * |
| wordfence | suremails | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the SureMail – SMTP and Email Logs Plugin for WordPress (versions up to 1.9.0). It allows unauthenticated attackers to upload files with dangerous types, such as malicious PHP scripts, because the plugin saves email attachments to a web-accessible directory without validating file extensions or content types. Although the plugin tries to block PHP execution via an Apache .htaccess file, this protection fails on servers like nginx, IIS, Lighttpd, or misconfigured Apache servers. Attackers can upload a malicious file, predict its filename (based on an MD5 hash of the content), and then execute arbitrary code remotely by accessing the file directly.
How can this vulnerability impact me? :
This vulnerability can lead to Remote Code Execution (RCE) on the affected server, allowing attackers to run arbitrary code without authentication. This can compromise the entire website and server, potentially leading to data theft, site defacement, malware distribution, or complete server takeover.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the SureMail – SMTP and Email Logs Plugin for WordPress to a version later than 1.9.0 where the issue is fixed. Additionally, ensure that the web server is properly configured to prevent execution of PHP files in the wp-content/uploads/suremails/attachments/ directory. For Apache servers, verify that the .htaccess file disabling PHP execution is effective. For nginx, IIS, Lighttpd, or misconfigured Apache servers, implement equivalent restrictions to block PHP execution in that directory. As a temporary measure, restrict public access to the upload directory or disable the plugin until a fix is applied.