Arbitrary File Upload Vulnerability in Podlove Podcast Publisher for WordPress
CVE-2025-10147
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 September 2025
What is CVE-2025-10147?
The Podlove Podcast Publisher plugin for WordPress has a vulnerability that allows unauthenticated attackers to upload arbitrary files due to insufficient file type validation in the 'move_as_original_file' function. This security flaw affects all versions up to and including 4.2.6, potentially enabling remote code execution on the server where the plugin is installed. Website administrators are advised to review their installations and apply appropriate security measures to mitigate risks.
Affected Version(s)
Podlove Podcast Publisher * <= 4.2.6