CVE-2025-135168.1HighCWE-434

CVE-2025-13516: SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload

brainstormforce · SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Prov…

Affected: brainstormforce SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Prov… · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.0%probability of exploitation in the next 30 days

64th percentile

050100

Higher than 64% of scored CVEs

8.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's save_file() function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessible directory (wp-content/uploads/suremails/attachments/) without validating file extensions or content types. Files are saved with predictable names derived from MD5 hashes of their content. While the plugin attempts to protect this directory with an Apache .htaccess file to disable PHP execution, this protection is ineffective on nginx, IIS, and Lighttpd servers, or on misconfigured Apache installations. This makes it possible for unauthenticated attackers to achieve Remote Code Execution by uploading malicious PHP files through any public form that emails attachments, calculating the predictable filename, and directly accessing the file to execute arbitrary code granted they are exploiting a site running on an affected web server configuration.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

brainstormforce · SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providersup to and including 1.9.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Unrestricted File Upload · File and Path Handling
Vendor: brainstormforce
Published: December 2025
Band: Possible (1 to 10%), December 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-13516 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.