Introduction
Attackers with Contributor-level access can upload arbitrary files to WordPress sites that run the Blubrry PowerPress plugin, which can lead to remote code execution and full site compromise. PowerPress has a large install base among podcasters, so the flaw affects content creators and organizations that distribute podcasts through WordPress.
Blubrry is a well-known podcast hosting and analytics provider. Its PowerPress plugin is one of the most widely used podcasting plugins for WordPress and runs on hundreds of thousands of sites. With that reach, a vulnerability in the plugin can affect a large part of both the podcasting and WordPress communities.
Technical Information
CVE-2025-13536 is a high-severity vulnerability (CVSS 8.8) in the Blubrry PowerPress Podcasting plugin for WordPress. It affects all versions up to and including 11.15.2, and it sits in the 'powerpress_edit_post' function. The plugin checks file extensions during upload, but a failed check does not stop the upload. Because of this logic flaw, any authenticated user with Contributor-level access or higher can upload files with dangerous extensions, such as PHP, to the server.
The uploaded files may end up in web-accessible directories (for example, wp-content/uploads), where an attacker can request and execute them over HTTP. That can lead to remote code execution, site takeover, and further compromise of the underlying server.
The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The vulnerable logic is in powerpressadmin.php at lines 2368, 3012, and 3068 in version 11.14.1:
To exploit it, an attacker uploads an executable file through the plugin's admin interface and gets past the intended file-type restrictions. Exploitation needs no complex technique and no privileges beyond Contributor-level access.
Detection Methods
The available sources do not describe detection methods specific to this plugin's vulnerabilities. Detection in WordPress plugins generally comes down to ongoing monitoring and analysis, and the following general practices apply to PowerPress as much as to any other plugin:
- Scan the site regularly with security tools. These tools find known vulnerabilities in plugins and themes by comparing installed versions against databases of reported issues.
- Watch the site's logs for unexpected behavior, such as unauthorized content changes, new administrative accounts, or unusual login attempts. Any of these can indicate an exploitation attempt.
- Subscribe to security advisories and vulnerability databases so you hear about newly discovered WordPress plugin vulnerabilities, including ones in PowerPress, in time to act on them.
- Deploy a web application firewall (WAF) to filter and monitor HTTP traffic between the site and the Internet. A WAF can help detect and block requests that try to exploit known vulnerabilities.
Affected Systems and Versions
- Product: Blubrry PowerPress Podcasting plugin for WordPress
- Affected versions: All versions up to and including 11.15.2
- Vulnerable configuration: Any WordPress installation with PowerPress plugin version 11.15.2 or earlier, where users with Contributor-level access or higher can upload files
Vendor Security History
Blubrry PowerPress has a history of security vulnerabilities, including stored XSS, CSRF, and SSRF issues. Previous vulnerabilities include:
- CVE-2025-64201 (CSRF, up to 11.13.12)
- CVE-2025-32691 (SSRF, up to 11.12.6)
The vendor usually patches quickly after disclosure. Version 11.15.3, for example, came out shortly after CVE-2025-13536 was reported. Still, how often these issues keep appearing suggests ongoing problems with the plugin's secure development practices.
