What is the CVSS score of CVE-2026-13001?

CVE-2026-13001 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of Podlove Podcast Publisher are affected by CVE-2026-13001?

Podlove Podcast Publisher WordPress plugin (through version 4.5.1) contains a critical vulnerability allowing remote attackers to upload arbitrary files to the server, potentially enabling complete…

Is there a public PoC exploit available for CVE-2026-13001?

Yes, a public proof-of-concept exploit is available for CVE-2026-13001. Prioritise patching immediately. EPSS: 1.1%.

How to fix or mitigate CVE-2026-13001?

Within 24 hours, disable the Podlove Podcast Publisher plugin and determine if it is operationally critical or if an alternative podcast publishing solution can replace it; if removal is not feasible, isolate the affected WordPress instance and deploy Web Application Firewall rules to block file uploads to the plugin's image cache directory. Within 7 days, contact Podlove project maintainers and your hosting provider for patch timeline estimates, conduct forensic review of server logs and file system for signs of exploitation, and implement file system-level upload restrictions on the cache directory. Within 30 days, monitor for patched versions above 4.5.1 from the Podlove project; apply immediately upon release to all affected installations after testing in non-production environments.

Podlove Podcast Publisher CVE-2026-13001

EUVD-2026-44402 CRITICAL

Improper Input Validation (CWE-20)

2026-07-14 Wordfence

GHSA-7gcx-p8g5-3g9x

WordPress RCE Podlove Podcast Publisher Wordpress Plugin

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but AC:H because exploitation requires influencing the cached image source and defeating existing partial validation; full RCE gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 21:05 vuln.today

Analysis Generated

Jul 14, 2026 - 21:05 vuln.today

CVE Published

Jul 14, 2026 - 19:33 nvd

CRITICAL 9.8

DescriptionCVE.org

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Articles & Coverage 1

News Critical Arbitrary File Upload in WordPress Podlove Podcast Publisher - CVE-2026-13001 Jul 15, 2026

AnalysisAI

Arbitrary file upload in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.1) allows remote attackers to place attacker-controlled files on the server via the image caching path, potentially escalating to remote code execution. The root cause is incomplete file-type validation in the plugin's image cache handling, where a cached file's extension was trusted rather than re-derived from the actual validated image type. Reported by Wordfence and fixed upstream; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is the plugin's remote image caching subsystem (Podlove\Model\Image), which downloads a source image via download_source() and stores it under a cache directory. The vulnerability is a CWE-20 improper input validation issue: the original is_image()/extension logic in lib/helper.php and lib/model/image.php determined whether a downloaded file was an image but did not consistently constrain the stored file extension. The upstream commit (5b32468) refactors validation into image_file_extension(), set_file_extension_from_validated_image(), and a new is_safe_image_extension() gate that requires wp_check_filetype() to return an 'image/*' MIME type, plus load_cached_file_extension() to sanitize extensions read back from the YAML cache metadata. The CPE identifies the product as cpe:2.3:a:eteubert:podlove_podcast_publisher, and the readme changelog explicitly labels the fix as 'a remote code execution vulnerability in the image cache caused by unsafe handling of cached image file extensions.'

RemediationAI

Upgrade to the patched release published on WordPress.org (the fix corresponds to trac changeset 3597461 and database migration version 166, delivered in the first release after 4.5.1); the exact patched version number is not stated in the provided data, so confirm against the plugin changelog before deploying. The upstream fix is available as commit 5b32468601e903bae2bcacfaf36ff583d2bc9387, which enforces that cached image extensions map to an image/* MIME type via wp_check_filetype() and flushes existing image caches on upgrade. If you cannot patch immediately, restrict or disable the plugin's remote image fetching/caching feature, block untrusted outbound sources the plugin can be pointed at, and deny direct web execution of files under the plugin's image cache directory (e.g., disable PHP execution in that upload/cache path via web-server config) - the trade-off is that legitimate remote cover-art/image caching will stop working. A WAF rule from Wordfence may provide virtual patching in the interim but is a stopgap, not a substitute for the update. Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/f81a3429-f378-4295-adbe-ad6f1df59701?source=cve.