Introduction
Attackers can gain remote code execution on WordPress sites running Podlove Podcast Publisher by uploading a malicious file. The vulnerability affects all plugin versions up to and including 4.2.6 and requires no authentication, which leaves thousands of podcasting sites open to full compromise.
Podlove Podcast Publisher is a WordPress plugin for managing and distributing podcast content, used by approximately 4000 active sites. It gives creators and organizations advanced publishing, analytics, and media management features.
Technical Information
CVE-2025-10147 is a critical vulnerability classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The root cause is missing file type validation in the move_as_original_file function of the Podlove Podcast Publisher plugin. This function handles file uploads, including images and media files attached to podcast episodes.
The affected code path does not restrict or validate the type of the uploaded file. An unauthenticated attacker can therefore send a crafted HTTP request to the plugin's upload endpoint with a file of any extension or content type. The plugin accepts the file and stores it on the server, where it is reachable over the web. If the file is a PHP script or another executable, the attacker can then trigger code execution by accessing it directly.
Public code references confirm that the vulnerable function has no file type checks:
As of the publication date, public advisories list no official patch and no detection methods.
Affected Systems and Versions
- Product: Podlove Podcast Publisher WordPress plugin
- Affected versions: All versions up to and including 4.2.6
- Vulnerable configuration: Any WordPress installation with the affected plugin enabled
Vendor Security History
Public databases record at least 19 vulnerabilities in Podlove Podcast Publisher. Recent ones include:
- Stored XSS via Feed Name (CVE-2025-0554, fixed in 4.2.0)
- Open redirect vulnerability (fixed in 4.2.6)
- Multiple XSS vulnerabilities in podcast summaries and unused code (fixed in 4.2.1 and 4.2.3)
The vendor typically releases patches when vulnerabilities are reported. Even so, the frequency of critical issues indicates persistent problems with its secure development and review processes.
