The Blubrry PowerPress Podcasting plugin for WordPress allows authenticated users with Contributor-level access to upload arbitrary files due to incomplete file type validation. The plugin checks file extensions but does not stop the upload when validation fails, letting an attacker place any file on the server. Depending on the uploaded file type, this can lead to remote code execution or other malicious actions on the site.

The vulnerability affects all installations of the Blubrry PowerPress Podcasting plugin through version 11.15.2 inclusive. Administrators, authors, editors, or any user with a Contributor role or higher who can edit posts with the plugin present are at risk.

The CVSS base score of 8.8 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests that exploitation probability is currently low. Although the vulnerability is not yet listed in CISA KEV, the possibility of remote code execution warrants immediate attention. Attackers would need valid Contributor credentials and access to the WordPress admin interface, after which they could upload a malicious file and execute it on the server.