Introduction
An attacker can get remote code execution on a WordPress site by uploading a malicious file through any public form. CVE-2025-13516 in the SureMail SMTP and Email Logs plugin for WordPress exposes over 200,000 sites to this risk. Exploitation needs no authentication and no user interaction beyond a form submission. Easy exploitation and the plugin's wide use across WordPress sites make this a significant vulnerability.
About SureMail and Brainstorm Force: SureMail is a widely used WordPress plugin from Brainstorm Force. The vendor has a strong presence in the WordPress plugin market, and its products are used by hundreds of thousands of sites. SureMail handles SMTP email delivery and logging, so for many organizations that run business operations on WordPress, it is critical infrastructure.
Technical Information
CVE-2025-13516 comes from missing file extension and content type validation in SureMail's file handling code. The flaw is in the save_file() function in inc/emails/handler/uploads.php. When a user submits a form with an attachment (through WPForms or Contact Form 7, for example), SureMail saves a copy of the attachment to wp-content/uploads/suremails/attachments/.
Four problems combine:
- The plugin does not validate file extensions or MIME types, so any file type, including
.php, can be uploaded. - The filename is the MD5 hash of the file content, so an attacker can precompute the name of their payload.
- Files are saved in a directory that the web server makes publicly accessible.
- The plugin tries to block PHP execution in that directory with an Apache
.htaccessfile. nginx, IIS, and Lighttpd do not honor that file, and neither does a misconfigured Apache server.
Together, these let an attacker upload a PHP payload through any public form that sends attachments, calculate the resulting filename, and access the file directly to execute arbitrary code on the server.
Relevant public code references:
Affected Systems and Versions
- SureMail SMTP and Email Logs WordPress plugin
- Affected versions: Up to and including 1.9.0
- Vulnerable configurations: Any WordPress site running SureMail ≤ 1.9.0, especially on nginx, IIS, Lighttpd, or misconfigured Apache servers where
.htaccessprotections are ineffective
Vendor Security History
Brainstorm Force has a history of addressing security vulnerabilities in its plugins and has issued security updates for SureMail and other products before. It patched this issue in version 1.9.1 after responsible disclosure. Similar unrestricted file upload vulnerabilities have affected other plugins in the WordPress ecosystem. Even so, a file upload flaw this basic indicates gaps in the vendor's secure development practices.
