CVE-2021-24123: PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-434

Description

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+) being able to upload arbitrary files, such as php, leading to RCE.

Affected products

PowerPress Podcasting plugin by Blubrry: before 8.3.8 — fixed in 8.3.8

How to fix

Upgrade to a fixed version: PowerPress Podcasting plugin by Blubrry 8.3.8. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/43aa30bf-eaf8-467a-93a1-78f9bdb37b36
https://wpscan.com/vulnerability/43aa30bf-eaf8-467a-93a1-78f9bdb37b36

Get alerted when CVE-2021-24123 or the next vulnerability affects your stack