The vulnerability allows an attacker to upload files of dangerous types through the PowerPress Podcasting plugin, enabling the placement of a web shell or other executable payload. This flaw, classified as CWE‑434, can compromise the confidentiality, integrity, and availability of the host system by allowing remote execution of arbitrary code.

Blubrry’s PowerPress Podcasting plugin is affected when running version 11.12.5 or any earlier release. The issue applies to any WordPress site that has the plugin enabled, regardless of deployment customizations.

The CVSS base score of 9.9 indicates critical severity, while the EPSS score is below 1 %, implying a low likelihood of exploitation relative to other vulnerabilities. The flaw has not been catalogued in CISA’s KEV. Attackers would exploit the plugin’s upload function, which is described as unrestricted; it likely requires authenticated access to the administrative interface, though the exact privilege level is not specified. Successful exploitation results in the attacker gaining full control over the affected web server.