WordPress Plugin Vulnerabilities

Podlove Podcast Publisher < 4.5.2 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

Description

The plugin is vulnerable to Arbitrary File Upload due to missing file type validation in the 'podlove_handle_cache_files' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
podlove-podcasting-plugin-for-wordpress
Fixed in 4.5.2

References

CVE
CVE-2026-13001
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f81a3429-f378-4295-adbe-ad6f1df59701

Miscellaneous

Original Researcher
Talal Nasraddeen
Verified
No
WPVDB ID
ae36fafc-2e8e-45aa-8ada-7505ecbfd71e

Timeline

Publicly Published
2026-07-14 (about 14 days ago)
Added
2026-07-16 (about 11 days ago)
Last Updated
2026-07-27 (about 49 minutes ago)

Other

Published
Title
Published
2025-02-21
Title
Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2025-09-22
Title
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) < 4.9.56 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'
Published
2021-06-29
Title
Super Progressive Web Apps < 2.1.13 - Authenticated (High Privileged) Arbitrary File Upload to RCE
Published
2024-06-14
Title
FooEvents for WooCommerce < 1.19.21 - Improper Authorization to (Contributor+) Arbitrary File Upload
Published
2021-04-02
Title
Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE