External risk intelligence

Podlove Podcast Publisher Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-10147

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, and plugins are integral parts of these web-accessible surfaces. As an unauthenticated file upload vulnerability, it is reachable by anyone accessing the public website.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Podlove Podcast Publisher plugin for WordPress, allowing unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Unauthenticated file uploads are possible.
Attackers can execute code remotely.
Confirm relevance and exposure to WordPress sites.

Attack Path

How an attacker could exploit the issue

An attacker can upload arbitrary files to a vulnerable WordPress server by exploiting a flaw in the Podlove Podcast Publisher plugin. This flaw allows unauthenticated users to bypass file type restrictions, potentially enabling them to upload malicious files that could lead to the execution of arbitrary code on the server.

Unauthenticated access to the website.
Uploading a specially crafted file.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to upload arbitrary files to the server hosting an affected WordPress site. When supported by the advisory, this could lead to the execution of malicious code on the server.

Arbitrary files could be uploaded.
Unauthenticated network access.
Potential for remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Podlove Podcast Publisher plugin for WordPress impacts any organization using the plugin to manage podcast content. Responsibility for addressing this likely falls to the web application or platform team that manages the WordPress instance, in coordination with the website owner who can identify business criticality and accountable personnel. The first practical step is to inventory all WordPress sites using the plugin, confirm reachability and business impact, and then prioritize remediation efforts.

WordPress application owners should own remediation.
Verify plugin usage and server accessibility.
Plan phased updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Podlove Podcast Publisher plugin?

Podlove Podcast Publisher is a WordPress extension designed to help content creators manage and distribute podcast feeds, episodes, and media files directly from their WordPress dashboard. It simplifies tasks like generating RSS feeds and handling media hosting integrations, making it a common tool for sites that host or syndicate audio content.

What does CWE-434 mean for CVE-2025-10147?

This CVE involves an 'Unrestricted Upload of File with Dangerous Type' (CWE-434). It means the plugin fails to properly check the format or extension of files being uploaded to the server. Because the system accepts these files without validation, an attacker can upload scripts that the web server might mistakenly execute.

How does an attacker trigger this vulnerability?

An attacker triggers this by interacting with the specific code function responsible for handling media uploads. It does not require a user to be logged in or have administrative rights. However, the flaw is specific to the plugin's file-handling process; simply visiting the website or viewing podcast pages normally does not trigger the vulnerability.

Do I need to worry if my WordPress site is internal?

Halo Surface Signal indicates that because this plugin is a standard part of web-accessible WordPress sites, it is most dangerous when the site is public-facing. If your instance is purely internal and restricted to a private network, the risk is lower, though it remains a security concern for any server hosting the plugin.

When should I take action for this vulnerability?

You should prioritize this immediately if you use this plugin. Begin by auditing your WordPress environment to identify every installation using the Podlove Podcast Publisher. Once you have a complete inventory, verify which sites are reachable by the public and coordinate with your web team to schedule necessary updates or removal of the plugin.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.