The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's save_file() function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessible directory (wp-content/uploads/suremails/attachments/) without validating file extensions or content types. Files are saved with predictable names derived from MD5 hashes of their content. While the plugin attempts to protect this directory with an Apache .htaccess file to disable PHP execution, this protection is ineffective on nginx, IIS, and Lighttpd servers, or on misconfigured Apache installations. This makes it possible for unauthenticated attackers to achieve Remote Code Execution by uploading malicious PHP files through any public form that emails attachments, calculating the predictable filename, and directly accessing the file to execute arbitrary code granted they are exploiting a site running on an affected web server configuration.
CVE-2025-13516
Score 8.1 from GitHub Security Advisory (severity: HIGH) published 2025-12-02. NVD baseline CVSS 8.1; sources differ by 0.0.
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 8.1
- EG Score
- 8.1(medium)
- EG Risk
- 37(Track)EG Risk 37/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity81% × 45%Exploitation1% × 40%Automatability0% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 1%
- EPSS %ILE
- 60%
- KEV
- Not listed
Published
December 2, 2025
Last Modified
April 15, 2026
References (6)
- security@wordfencehttps://cwe.mitre.org/data/definitions/434.html
- security@wordfencehttps://plugins.trac.wordpress.org/browser/suremails/trunk/inc/admin/plugin.php#L407
- security@wordfencehttps://plugins.trac.wordpress.org/browser/suremails/trunk/inc/emails/handler/uploads.php#L113
- security@wordfencehttps://plugins.trac.wordpress.org/browser/suremails/trunk/inc/emails/handler/uploads.php#L231
- security@wordfencehttps://plugins.trac.wordpress.org/changeset/3403145/suremails/trunk?contextall=1&old=3389326&old_path=%2Fsuremails%2Ftrunk
- security@wordfencehttps://www.wordfence.com/threat-intel/vulnerabilities/id/f3a20047-a325-4d29-a848-7ffa525d0bad?source=cve
Related CVEs
Related CVEs are temporarily unavailable — the same-product, same-vendor and same-CWE lists could not be loaded just now. That is not a sign that none exist; please retry shortly.
Frequently asked(5)
What is CVE-2025-13516?
When was CVE-2025-13516 disclosed?
Is CVE-2025-13516 actively exploited?
What is the CVSS score of CVE-2025-13516?
How do I remediate CVE-2025-13516?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2025-13516
Is Your Infrastructure Affected by CVE-2025-13516?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.