CVE-2026-13001

CRITICAL

Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

Title source: cna

Exploitation Summary

EIP tracks 3 public exploits for CVE-2026-13001. PoCs published by sadb98523-eng, shinthink, Raimu0x19.

AI-analyzed exploit summary This is a functional PHP web shell exploiting CVE-2026-13001, providing unauthenticated remote command execution (RCE) via GET/POST parameters, file upload capabilities, and system information disclosure. The shell is password-protected but defaults to a hardcoded value ('sadboy').

Description

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Exploits (3)

github WORKING POC

by sadb98523-eng · poc

https://github.com/sadb98523-eng/CVE-2026-13001

View Code ZIP pw:eip

This is a functional PHP web shell exploiting CVE-2026-13001, providing unauthenticated remote command execution (RCE) via GET/POST parameters, file upload capabilities, and system information disclosure. The shell is password-protected but defaults to a hardcoded value ('sadboy').

Classification

Working Poc 99%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Unknown (CVE-2026-13001 not yet mapped to specific software in this PoC)

No auth needed

Prerequisites: PHP environment with disabled `disable_functions` for full RCE (or fallback to limited execution methods) · Ability to upload/write the PHP file to a web-accessible directory · Knowledge of the hardcoded password ('sadboy') or ability to brute-force it

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 17, 2026 Full analysis →

github WORKING POC

by shinthink · pythonpoc

https://github.com/shinthink/CVE-2026-13001

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-13001, a critical unauthenticated file upload RCE in Podlove Podcast Publisher <= 4.5.1. The exploit leverages a mismatch between `is_image()` and `extract_file_extension()` functions to upload a GIF89a PHP polyglot that bypasses image validation but executes as PHP.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Podlove Podcast Publisher WordPress plugin <= 4.5.1

No auth needed

Prerequisites: Target must have Podlove Podcast Publisher plugin installed (<= 4.5.1) · Attacker must host a malicious payload (GIF89a PHP polyglot) on an accessible server

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 16, 2026 Full analysis →

github WORKING POC

by Raimu0x19 · pythonpoc

https://github.com/Raimu0x19/CVE-2026-13001

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-13001, an unauthenticated arbitrary file upload vulnerability in Podlove Podcast Publisher ≤ 4.5.1. The exploit leverages a mismatch in extension parsing functions to upload a GIF89a PHP polyglot file, which bypasses image validation but executes as PHP, leading to RCE.

Classification

Working Poc 99%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Podlove Podcast Publisher ≤ 4.5.1 (WordPress plugin)

No auth needed

Prerequisites: Target must have Podlove Podcast Publisher ≤ 4.5.1 installed · Attacker must host a malicious file (GIF89a PHP polyglot) or use the built-in local server · Target must be able to fetch the attacker-controlled URL (e.g., via HTTP)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 15, 2026 Full analysis →