CVE-2025-10147: Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'moveasoriginalfile' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10147?
CVE-2025-10147 is classified as a high severity vulnerability due to its potential for arbitrary file uploads by unauthenticated attackers.
How do I fix CVE-2025-10147?
To fix CVE-2025-10147, you should update the Podlove Podcast Publisher plugin to version 4.2.7 or later, which addresses the file upload validation issue.
What is the impact of CVE-2025-10147?
The impact of CVE-2025-10147 allows attackers to upload arbitrary files, which could lead to code execution and complete site compromise.
Which versions of Podlove Podcast Publisher are affected by CVE-2025-10147?
CVE-2025-10147 affects all versions of Podlove Podcast Publisher up to and including version 4.2.6.
Who can be affected by CVE-2025-10147?
Any WordPress site using the Podlove Podcast Publisher plugin version 4.2.6 or earlier is vulnerable to CVE-2025-10147, regardless of authentication.