Podlove Podcast Publisher CVE-2026-13001

Exploitation targets the Podlove image caching feature: the attacker must get the plugin to download and cache a file via its Model\Image download_source() path and cause the cached file to be stored with an executable extension that slips past the pre-fix MIME/extension checks in is_image(); web-execution of files in the cache directory must also be possible for the upload to reach RCE. The CVSS vector asserts unauthenticated network access with no user interaction (AV:N/AC:L/PR:N/UI:N), implying default-configuration reachability, but the source code indicates the flaw is specifically in unsafe handling of cached image file extensions rather than an open upload endpoint - meaning realistic exploitation depends on an attacker's ability to influence the image source URL/content the plugin caches. Limiting factors: only the image cache path is affected, the pre-existing partial validation must be bypassed, and server configuration that forbids PHP execution in the cache/upload directory would block the RCE step.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) rates this as critical and unauthenticated, and the RCE tag plus a WordPress deployment model make it attractive if reachable. However, the source evidence shows exploitation flows through the image cache download path, so an attacker must be able to influence the source URL/file that the plugin fetches and caches, and must defeat the pre-existing partial MIME/extension checks - conditions that arguably raise attack complexity above the AC:L asserted by NVD. No EPSS score, KEV entry, or POC was provided in the input, so there is no evidence of active or automated exploitation at this time; the priority rests on the high theoretical impact and the confirmed vendor RCE classification rather than observed activity. Net: treat as a high-priority patch for any site running the plugin, but note the gap between the 'no special conditions' implied by CVSS:3.1/PR:N and the config-/URL-dependent mechanism visible in the code - verify reachability in your deployment.

An attacker induces the plugin to fetch and cache an image from an attacker-controlled source, crafting the download so the cached file retains a dangerous (e.g., PHP) extension that bypasses the incomplete image validation. The malicious file lands in the plugin's cache directory, and the attacker then requests it directly to execute code as the web server user. No public POC was provided, and given AV:N/AC:L the request itself is network-based, though the code path suggests non-trivial conditions on controlling the cached file.