EUVD-2026-59854
GHSA-q83h-6954-x259
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
REST API exploitable over network (AV:N); contributor auth required (PR:L); wp-config.php deletion yields full confidentiality, integrity, and availability impact with no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). A viable POP chain exists within the plugin itself via Podlove\ImageCache\GenerationGuard, whose __destruct() method invokes wp_delete_file() with an attacker-controlled file path populated through unserialization.
AnalysisAI
Arbitrary file deletion leading to remote code execution in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.3) allows authenticated contributors to destroy critical server files and fully compromise the WordPress installation. The root cause is a PHP deserialization flaw in the shownotes REST API that activates a native POP chain via GenerationGuard::__destruct(), invoking wp_delete_file() on an attacker-controlled path - enabling deletion of wp-config.php to force WordPress into reinstallation mode. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the POP chain is explicitly mapped in the CVE with source code references, indicating high confidence in exploitability.
Technical ContextAI
The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) within a PHP WordPress plugin. The create_link_item function in the shownotes REST API (rest_api.php, lines 538, 585, 630) fails to validate file paths prior to processing, and accepts serialized PHP objects without sanitization. A Property Oriented Programming (POP) chain exists natively within the plugin: the __destruct() magic method of Podlove\ImageCache\GenerationGuard (generation_guard.php, lines 19 and 57) is invoked during object destruction after unserialization, and internally calls wp_delete_file() with an attacker-controlled file path sourced from the deserialized object's properties. WordPress's wp_delete_file() wraps PHP's unlink(), making file deletion on the server trivially achievable once the path is controlled. The affected CPE is cpe:2.3:a:eteubert:podlove_podcast_publisher:*:*:*:*:*:*:*:*, covering all versions through 4.5.3.
RemediationAI
An upstream fix is available as WordPress plugin repository changeset 3648110 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3648110%40podlove-podcasting-plugin-for-wordpress&new=3648110%40podlove-podcasting-plugin-for-wordpress); however, a confirmed patched release version number was not independently verifiable from the provided input data - site operators should update to the latest available version via the WordPress plugin dashboard and confirm the installed version exceeds 4.5.3 once a tagged release is published. As an immediate compensating control, restrict contributor-level user registration if it is not operationally required, which removes the primary attacker prerequisite. WordPress installations using a WAF (such as Wordfence Premium) should enable firewall rules targeting PHP deserialization payloads on REST API endpoints. If the Shownotes module of the plugin is not in use, disabling it via plugin settings removes the vulnerable REST API endpoint entirely without affecting core podcast publishing functionality. Restricting filesystem write permissions so the web server user cannot delete files outside the uploads directory would mitigate the file deletion impact, though this may break other WordPress functionality.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today