PT-2025-17763 · Angelo Mandato · Powerpress Podcasting

Trương Hữu Phúc · Published 2025-04-24 · Updated 2025-04-26 · CVE-2025-46264

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Angelo Mandato PowerPress Podcasting versions prior to 11.12.6

Description The issue allows attackers to upload dangerous files, potentially leading to the upload of a web shell to a web server. This can be exploited through unrestricted file upload, which may enable attackers to execute malicious code on the server.

Recommendations For versions prior to 11.12.6, update to version 11.12.6 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only allow safe file types until a patch is applied. Restrict access to the file upload functionality to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-46264

Affected Products

Powerpress Podcasting

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-46264 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-11-12-7-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1915444104021807291 · Twitter Post
• https://twitter.com/CVEnew/status/1915454244171243775 · Twitter Post
• https://twitter.com/cybercronai/status/1915926502979297336 · Twitter Post
• https://twitter.com/cybercronai/status/1915742708892660206 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-11-12-7-arbitrary-file-upload-vulnerability?_s_id=cve · Note