CVE-2025-13069
🗓️ 18 Nov 2025 09:27:37Reported by WordfenceType 
cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 31 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2025-13069 | 18 Nov 202511:54 | – | circl |
 | WordPress plugin Enable SVG, WebP, and ICO Upload 代码问题漏洞 | 18 Nov 202500:00 | – | cnnvd |
 | CVE-2025-13069 Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass | 18 Nov 202509:27 | – | cvelist |
 | EUVD-2025-197965 | 18 Nov 202512:30 | – | euvd |
 | CVE-2025-13069 | 18 Nov 202510:15 | – | nvd |
 | 📄 WordPress Enable SVG, WebP and ICO Upload 1.1.2 Shell Upload | 21 Jul 202600:00 | – | packetstorm |
 | WordPress Enable SVG, WebP, and ICO Upload plugin <= 1.1.2 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass vulnerability | 18 Nov 202504:46 | – | patchstack |
 | PT-2025-47285 | 18 Nov 202500:00 | – | ptsecurity |
 | CVE-2025-13069 | 19 Nov 202510:23 | – | redhatcve |
 | CVE-2025-13069 Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass | 18 Nov 202509:27 | – | vulnrichment |
10
Node
[
{
"vendor": "ideastocode",
"product": "Enable SVG, WebP, and ICO Upload",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.1.3",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| log | path | \/wp-login.php | Authenticated user login used to initiate exploit flow (Author+ required). | CWE-434 |
| pwd | path | \/wp-login.php | Authenticated user login used to initiate exploit flow (Author+ required). | CWE-434 |
| wp-submit | path | \/wp-login.php | Authenticated user login used to initiate exploit flow (Author+ required). | CWE-434 |
| redirect_to | path | \/wp-login.php | Authenticated user login used to initiate exploit flow (Author+ required). | CWE-434 |
| testcookie | path | \/wp-login.php | Authenticated user login used to initiate exploit flow (Author+ required). | CWE-434 |
| _wpnonce | path | \/wp-admin\/media-new.php | Acquires media form nonce used to authorize the AJAX upload flow. | CWE-434 |
| action | request body | \/wp-admin\/admin-ajax.php | AJAX uploader call used to upload a crafted ICO PHP file to the uploads directory. | CWE-434 |
| _wpnonce | request body | \/wp-admin\/admin-ajax.php | AJAX uploader call used to upload a crafted ICO PHP file to the uploads directory. | CWE-434 |
| name | request body | \/wp-admin\/admin-ajax.php | AJAX uploader call used to upload a crafted ICO PHP file to the uploads directory. | CWE-434 |
| async-upload | request body | \/wp-admin\/admin-ajax.php | AJAX uploader call used to upload a crafted ICO PHP file to the uploads directory. | CWE-434 |
10
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 08:33Current
6.6Medium risk
Vulners AI Score6.6
CVSS 3.18.8
EPSS0.00634
SSVC