Arbitrary File Upload Vulnerability in Blubrry PowerPress Plugin for WordPress
CVE-2025-13536
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 November 2025
What is CVE-2025-13536?
The Blubrry PowerPress plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or higher to upload arbitrary files. This stems from insufficient validation of file types, where the plugin only checks file extensions without preventing execution when validation fails during the 'powerpress_edit_post' function. Exploiting this flaw could potentially lead to remote code execution on the server hosting the affected WordPress site.
Affected Version(s)
PowerPress Podcasting plugin by Blubrry * <= 11.15.2