CVE-2025-13536: Blubrry PowerPress WordPress RCE Flaw

CVE-2025-13536 Overview

The Blubrry PowerPress plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions through 11.15.2. The flaw resides in the powerpress_edit_post function, which validates file extensions but fails to halt execution when validation fails. Authenticated attackers holding Contributor-level access or higher can upload arbitrary files to the affected server. Successful exploitation can lead to remote code execution on the underlying WordPress host. The weakness is categorized as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated Contributor accounts can upload arbitrary files to vulnerable WordPress sites running PowerPress, enabling potential remote code execution and full site compromise.

Affected Products

Blubrry PowerPress Podcasting plugin for WordPress
All plugin versions up to and including 11.15.2
WordPress sites permitting Contributor-level account registration or with compromised low-privilege accounts

Discovery Timeline

2025-11-27 - CVE-2025-13536 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13536

Vulnerability Analysis

The PowerPress plugin exposes file upload functionality through the powerpress_edit_post function in powerpressadmin.php. The function inspects the extension of submitted files against an allow-list of expected media types. When the extension check fails, the code logs or flags the condition but does not stop processing. Execution continues to the file write operation, persisting attacker-controlled content to the server.

A Contributor account is sufficient because the plugin gates access to the edit endpoint at a low capability level. Once a malicious file lands inside the WordPress uploads directory, the attacker can request it via HTTP to trigger server-side execution if the file is a PHP script. This converts a content-management role into full code execution on the host.

Root Cause

The root cause is incomplete enforcement of file type validation. The powerpress_edit_post function performs validation but does not return or short-circuit on failure. This control-flow defect allows untrusted file content to reach the upload sink even after the validator marks it invalid. References to the vulnerable code paths are available in the WordPress PowerPress source at line 2368, line 3012, and line 3068.

Attack Vector

The attack proceeds over the network against the WordPress admin interface. An authenticated user with Contributor privileges or above submits a crafted post-edit request to the PowerPress endpoint. The request includes a file with an executable extension such as .php or a polyglot payload designed to bypass static checks. Because validation does not stop processing, the file is written to the uploads path. The attacker then issues an HTTP request to the resulting URL to execute code under the web server account. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-13536

Indicators of Compromise

New or unexpected .php, .phtml, or .phar files inside wp-content/uploads/powerpress/ or sibling media directories
Outbound network connections originating from the PHP-FPM or web server process after a Contributor account interacts with PowerPress
WordPress access logs showing POST requests to PowerPress admin actions followed by GET requests to newly created upload paths
Modifications to PowerPress-related post metadata immediately preceding the appearance of new files in the uploads directory

Detection Strategies

Inspect WordPress audit logs for Contributor-level accounts invoking PowerPress edit actions outside of normal podcast publishing workflows
Hash and baseline files in the wp-content/uploads tree and alert on the introduction of script extensions
Monitor web server logs for direct requests to files inside uploads/ with executable extensions, which is abnormal under default WordPress behavior

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and uploads directory
Forward WordPress, PHP, and web server logs to a centralized analytics platform for correlation across authentication, upload, and execution events
Alert on creation of files with double extensions such as image.jpg.php inside any media-managed directory

How to Mitigate CVE-2025-13536

Immediate Actions Required

Update the Blubrry PowerPress plugin to the version released in WordPress changeset 3402635, which addresses the validation defect
Audit all Contributor, Author, and Editor accounts and remove or rotate credentials for any unrecognized users
Inspect the wp-content/uploads directory for unexpected executable files and remove confirmed malicious artifacts
Rotate WordPress secret keys, database credentials, and administrator passwords if compromise is suspected

Patch Information

The vendor fix is committed in WordPress plugin changeset 3402635. Versions following 11.15.2 contain the corrected validation flow that halts execution when a submitted file fails extension checks. Site operators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Deactivate the PowerPress plugin until the patched version is installed
Restrict Contributor and Author role assignments to trusted users only and disable open registration
Configure the web server to deny PHP execution within wp-content/uploads using directory-level handlers or location blocks
Place a Web Application Firewall rule in front of the PowerPress admin endpoints to block requests carrying script file extensions

bash

# Example nginx rule to block PHP execution under WordPress uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php7|php8)$ {
    deny all;
    return 403;
}