CVE-2025-13536 is an arbitrary file upload vulnerability in the Blubrry PowerPress Podcasting plugin for WordPress. The issue arises because the plugin validates file extensions but fails to halt processing when validation fails in the 'powerpress_edit_post' function. This allows authenticated users with at least Contributor privileges to upload files of dangerous types to the server. Such uploads may enable remote code execution, compromising the affected WordPress site. The vulnerability affects all versions up to and including 11.15.2 and has a CVSS 3.1 base score of 8.8, indicating high severity.

An attacker with Contributor-level or higher access can upload arbitrary files to the server hosting the vulnerable WordPress plugin. This can lead to remote code execution, potentially allowing full compromise of the affected site. The vulnerability impacts confidentiality, integrity, and availability of the system as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Blubrry's official channels for updates. Until a fix is available, restrict Contributor-level access where possible and consider disabling or replacing the plugin to mitigate risk.