CVE-2026-13001Patch

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Back to dashboard

5.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-20

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
5 mentions across 4 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked 3d ago at 2 mentions (2026-07-15); latest day: 1
5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Patch

360.0%

PoC

120.0%

Disclosure

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	2	Patch2
2026-07-17	1	Patch1
2026-07-27	1	PoC1
2026-08-18	1	Disclosure1

Full discourse5 posts

pdnuclei-bot@pdnuclei_bot57d
Disclosure
🚨 CVE-2026-13001 - critical 🚨 Podlove Podcast Publisher <= 4.5.1 - Arbitrary File Upload > Podlove Podcast Publisher plugin for WordPress through 4.5.1 is vulnerable to arbitra... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-13001 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE‑2026‑13001, identifies it as a critical arbitrary file upload flaw in Podlove Podcast Publisher <=4.5.1, but offers no PoC, exploit code, active exploitation evidence, or patch details.
00012242
1.2K followersView on X
ExploitGrid@exploitgrid88d
Patch
🚨 Patch SonicWall SMA1000 now — CVE-2026-15409 (CVSS 10.0 SSRF) is being exploited in the wild, now in CISA's KEV. Also this week: CVE-2026-13001 (Podlove WP plugin RCE, 9.8), CVE-2026-14960 (Pegatron driver LPE, 9.8), MSFT Patch Tuesday. For more: http://exploitgrid.net
Post summary
CVE-2026-15409 (SSRF) is actively exploited and listed in CISA's KEV; SonicWall urges prompt patching of the SMA1000, while other high‑severity CVEs are highlighted with additional details available on ExploitGrid.
0101060
26 followersView on X
Jonas Knipper@jdker79d
PoC
@Schmidtlepp Hi, FYI: Dein Podlove wurde gehackt, Sicherheitslücke ist diese hier: https://github.com/shinthink/CVE-2026-13001 https://t.co/UJmkrR0nII
Post summary
The tweet points to a GitHub repository containing a Proof of Concept for CVE‑2026‑13001, indicating the vulnerability exists and has been demonstrated, but offers no patch information, technical details, or evidence of ongoing exploitation.
1000064
399 followersView on X
John Spurlock@johnspurlock91d
Patch
‘Podlove Publisher 4.5.2 fixes CVE-2026-13001, a critical vulnerability in the image cache that could allow unauthenticated remote code execution on affected installations.’ https://podlove.org/blog/security-release-cve-2026-13001
Post summary
The post announces a security release that patches CVE‑2026‑13001, a critical image‑cache RCE vulnerability in Podlove Publisher 4.5.2, with no known active exploitation or PoC disclosed.
00010107
684 followersView on X
Herr Rpunkt@herrrpunkt91d
Patch
Alle #Podlove -Nutzenden unter WP sollten fix auf Version 4.5.2 aktualisieren. Das Update schließt die kritische Sicherheitslücke CVE-2026-13001, die unauthentifizierte Remote Code Execution über den Image-Cache ermöglicht. https://podlove.org/blog/security-release-cve-2026-13001
Post summary
The release note announces that Podlove 4.5.2 patch fixes CVE‑2026‑13001, a critical unauthenticated RCE possible through the image cache. Updating to this version resolves the security issue.
0000054
1.4K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-13001

John Spurlock[verified]@johnspurlockPatch

The post announces a security release that patches CVE‑2026‑13001, a critical image‑cache RCE vulnerability in Podlove Publisher 4.5.2, with no known active exploitation or PoC disclosed.

pdnuclei-bot@pdnuclei_botDisclosure

The tweet announces CVE‑2026‑13001, identifies it as a critical arbitrary file upload flaw in Podlove Podcast Publisher <=4.5.1, but offers no PoC, exploit code, active exploitation evidence, or patch details.

ExploitGrid@exploitgridPatch

CVE-2026-15409 (SSRF) is actively exploited and listed in CISA's KEV; SonicWall urges prompt patching of the SMA1000, while other high‑severity CVEs are highlighted with additional details available on ExploitGrid.

Jonas Knipper@jdkerPoC

The tweet points to a GitHub repository containing a Proof of Concept for CVE‑2026‑13001, indicating the vulnerability exists and has been demonstrated, but offers no patch information, technical details, or evidence of ongoing exploitation.

Herr Rpunkt@herrrpunktPatch

The release note announces that Podlove 4.5.2 patch fixes CVE‑2026‑13001, a critical unauthenticated RCE possible through the image cache. Updating to this version resolves the security issue.