Podlove Podcast Publisher Unauthenticated Arbitrary File Upload via podlove_handle_cache_files (CVE-2026-13001) Advisory

Vulnerability Overview Vulnerability Name: Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload CVE ID: CVE-2026-13001 CVSS Score: 9.8 (Critical) Publication Date: July 14, 2026 Last Updated: July 14, 2026 Researcher: Talal NasraDeen Impact Scope Software Type: Plugin Software Name: Podlove Podcast Publisher Affected Versions: <= 4.5.1 Fixed Version: 4.5.2 Remediation Recommendation: Upgrade to version 4.5.2 or higher. Vulnerability Description The Podlove Podcast Publisher plugin contains an unauthenticated arbitrary file upload vulnerability due to missing file type validation in the function. This allows attackers to upload arbitrary files to the affected site's server, potentially leading to remote code execution. Reference Links plugins.trac.wordpress.org github.com plugins.trac.wordpress.org Related Vulnerabilities CVE-2026-32448: Podlove Podcast Publisher <= 4.3.3 - Authenticated (Contributor) Stored Cross-Site Scripting CVE-2025-10147: Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload CVE-2025-58204: Podlove Podcast Publisher <= 4.2.5 - Open Redirect CVE-2025-1383: Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via function CVE-2024-13729: Podlove Podcast Publisher <= 4.1.23 - Authenticated (Admin) Stored Cross-Site Scripting CVE-2024-13730: Podlove Podcast Publisher <= 4.2.0 - Authenticated (Admin) Stored Cross-Site Scripting CVE-2025-0554: Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin) Stored Cross-Site Scripting via Feed Name CVE-2024-52393: Podlove Podcast Publisher <= 4.1.15 - Authenticated (Admin) Remote Code Execution CVE-2024-43983: Podlove Podcast Publisher <= 4.1.13 - Authenticated (Contributor) Stored Cross-Site Scripting CVE-2024-43984: Podlove Podcast Publisher <= 4.1.13 - Cross-Site Request Forgery to Remote Code Execution Other Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Copyright Information Copyright: 2012-2026 Defiant Inc. License: Used under the terms of Defiant Inc.'s license agreement Contact Information Email: info@support@wordfence.com Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Email: Email Footer Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscriptions: Subscribe for news and updates Other Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Icons X: X Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Subscription Form Email: Email Input Terms Agreement: Terms Agreement Checkbox Subscribe Button: Subscribe Button Copyright Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wordfence Intelligence: Wordfence Intelligence Other Wo

Goal Reached Thanks to every supporter — we hit 100%!

Podlove Podcast Publisher Unauthenticated Arbitrary File Upload via podlove_handle_cache_files (CVE-2026-13001) Advisory

More from this source