Description

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). A viable POP chain exists within the plugin itself via Podlove\ImageCache\GenerationGuard, whose __destruct() method invokes wp_delete_file() with an attacker-controlled file path populated through unserialization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-16T05:16:47.780Z",
  "pubdate": "2026-08-16T05:16:47.780Z",
  "executiveSummary": "The Podlove Podcast Publisher plugin for WordPress is susceptible to an arbitrary file deletion vulnerability in all versions up to, and including, 4.5.3, caused by insufficient file path validation within the create_link_item function. This security flaw enables authenticated attackers possessing contributor-level access and above to delete arbitrary files located on the underlying web server.\nThe primary risk implication of this vulnerability is the potential escalation to remote code execution. If an attacker successfully deletes critical configuration files such as wp-config.php, it can force the WordPress installation into a reinstallation state or facilitate further system compromise.\nExploitation requires authenticated access with a minimum privilege level of a contributor. The attack vector leverages insecure deserialization coupled with a viable Property Oriented Programming (POP) chain residing internally within the plugin. Specifically, the __destruct() method of Podlove\\ImageCache\\GenerationGuard interacts with attacker-controlled data to invoke wp_delete_file() targeting arbitrary file paths.\nThis vulnerability highlights risks associated with inadequate input sanitization and insecure object handling in WordPress plugins, necessitating immediate administrative intervention to secure affected systems.",
  "technicalDetails": "The vulnerability originates in the Podlove Podcast Publisher plugin for WordPress in all versions up to, and including, 4.5.3. The root cause is insufficient file path validation implemented within the create_link_item function, which improperly handles user-supplied input intended for file operations.\nThe vulnerable component is the create_link_item function, combined with an internal POP chain located within the Podlove\\ImageCache\\GenerationGuard class. The __destruct() method of this class automatically invokes the wp_delete_file() function when the object is destroyed, utilizing an attacker-controlled file path that has been populated through insecure unserialization.\nTo execute an attack, an authenticated adversary with contributor-level privileges or higher must supply serialized data containing a crafted instance of the Podlove\\ImageCache\\GenerationGuard class. When PHP unserializes this payload and subsequently triggers the destructor lifecycle method, the class passes the malicious file path directly to the file deletion routine.\nBecause path validation is absent or insufficient in create_link_item, the application fails to restrict file deletion operations to designated safe directories. As a result, the attacker can specify absolute or relative paths targeting critical system or application files.\nThe post-exploitation impact is severe. By targeting and deleting critical application files such as wp-config.php, an attacker can disrupt service availability, bypass authentication mechanisms, or induce conditions leading to remote code execution if the application attempts to reinitialize without the core configuration file.\nThe attack requires network access to the WordPress administrative or front-end interface where the vulnerable function is exposed, along with valid credentials granting at least contributor-level privileges."
}