The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing…

The Podlove Podcast Publisher plugin exposes a move_as_original_file routine in lib/model/image.php that accepts uploads without validating file type, extension, or MIME. An unauthenticated HTTP request can drop a .php webshell into a web-accessible directory, giving the attacker code execution as the webserver user on any WordPress instance running the plugin. Everything at and below version 4.2.6 is affected; 4.2.7 ships the fix.

The vendor 9.8 label is *technically* correct for the shape of the bug — no auth, no interaction, RCE — but it ignores population. Wordfence/WPScan-class CVSS scoring rewards raw ergonomics, not exposure. With ~4,000 active installs on a niche podcasting plugin, this is a HIGH by any real-world blast-radius measure, not a fleet-melting CRITICAL like a WooCommerce or Elementor bug of the same shape.

Why this verdict

• Unauth RCE with zero friction on affected sites: no capability check, no nonce, no MIME validation — a single curl POST wins. On any host actually running Podlove ≤ 4.2.6 with PHP execution permitted in uploads, this is a full site takeover.
• Installed base narrows the fleet math: ~4,000 sites globally versus millions for a plugin like Elementor. In a 10,000-host enterprise, you are unlikely to have more than one or two instances, typically on a marketing/podcasting subsite — not the identity plane.
• Role multiplier — WordPress marketing/podcast tier: compromise ends at the site boundary on managed hosting or at the VPS boundary on self-hosted. This plugin is not deployed on identity providers, hypervisors, CI runners, or backup servers. Blast radius is site-scale, not fleet-scale. Verdict floor stays at HIGH, does not reach CRITICAL.
• No KEV, low EPSS, no observed campaigns: attacker interest tracks target density, and the target density here is low. But because the bug is easy, expect opportunistic scanning once a PoC is published.
• Compensating controls are cheap: deny .php execution under wp-content/uploads, put the site behind Wordfence or Patchstack, or simply update — no complex regression testing required for a plugin-level bump.

Why not higher?

Not CRITICAL because installed base is negligible (~4K sites) and the affected component does not sit on an identity, hypervisor, backup, edge, or CI role where compromise cascades. Blast radius stops at a single WordPress tenant. No active exploitation, no KEV, EPSS well under 1%.

Why not lower?

Not MEDIUM because for the ~4,000 sites actually running Podlove ≤ 4.2.6, this is an *unauthenticated* pre-auth RCE with a trivial one-request exploit path. Any site running it gets fully owned; there is no meaningful workflow friction. MEDIUM would imply the attacker needs auth or a rare configuration — neither is true here.

1. Upgrade Podlove Podcast Publisher to 4.2.7 or later — This is the primary fix and the fastest path. wp plugin update podlove-podcasting-plugin-for-wordpress via WP-CLI takes seconds and requires no schema migration. Deploy within 30 days per the noisgate mitigation SLA for HIGH; ideally same-day on public-facing WP.
2. Deny PHP execution under wp-content/uploads/ — Drop an .htaccess with <FilesMatch "\.php$"> Require all denied </FilesMatch> or an Nginx location ~ ^/wp-content/uploads/.*\.php$ { deny all; } block. This kills the RCE step even if the upload lands. Standard WP hardening — deploy fleet-wide within 30 days regardless of this CVE.
3. Deploy Wordfence, Patchstack, or a virtual-patching WAF in front of affected sites — Both vendors ship a virtual patch for CVE-2025-10147 that blocks the vulnerable request signature. Buys time on any site you cannot immediately update. Deploy within 30 days.
4. File Integrity Monitoring on wp-content/plugins/ and wp-config.php — Use Wordfence, Sucuri, or Tripwire to alert on new .php files in unexpected paths. Catches successful exploitation and post-exploit persistence (mu-plugins backdoors). Standing control.

Run from the WordPress host as any user with read access to the webroot, or from an auditor workstation via SSH. Pass the WordPress install path as the first argument, e.g. ./check-cve-2025-10147.sh /var/www/html. No elevated privileges required — this is a read-only version check.

#!/usr/bin/env bash
# noisgate verifier — CVE-2025-10147 (Podlove Podcast Publisher <= 4.2.6)
# Usage: ./check-cve-2025-10147.sh /path/to/wordpress
# Exit codes: 0 = PATCHED / NOT INSTALLED, 1 = VULNERABLE, 2 = UNKNOWN

set -u
WP_ROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/podlove-podcasting-plugin-for-wordpress"
FIXED_VERSION="4.2.7"

if [[ ! -d "$WP_ROOT" ]]; then
  echo "UNKNOWN: WordPress root '$WP_ROOT' not found"
  exit 2
fi

if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "PATCHED: Podlove Podcast Publisher not installed at $WP_ROOT"
  exit 0
fi

# Extract Version: header from main plugin file
PLUGIN_FILE="$PLUGIN_DIR/podlove.php"
if [[ ! -f "$PLUGIN_FILE" ]]; then
  # fall back to any php file with a plugin header
  PLUGIN_FILE=$(grep -rl "Plugin Name:.*Podlove" "$PLUGIN_DIR" 2>/dev/null | head -n1)
fi

if [[ -z "${PLUGIN_FILE:-}" || ! -f "$PLUGIN_FILE" ]]; then
  echo "UNKNOWN: could not locate Podlove plugin header file"
  exit 2
fi

VERSION=$(grep -iE '^\s*\*?\s*Version:' "$PLUGIN_FILE" | head -n1 | sed -E 's/.*Version:\s*//I' | tr -d '\r' | awk '{print $1}')

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: version header not readable in $PLUGIN_FILE"
  exit 2
fi

# Version comparison via sort -V
LOWEST=$(printf '%s\n%s\n' "$VERSION" "$FIXED_VERSION" | sort -V | head -n1)
if [[ "$VERSION" == "$FIXED_VERSION" || "$LOWEST" == "$FIXED_VERSION" ]]; then
  echo "PATCHED: Podlove Podcast Publisher $VERSION (>= $FIXED_VERSION)"
  exit 0
else
  echo "VULNERABLE: Podlove Podcast Publisher $VERSION (< $FIXED_VERSION) — CVE-2025-10147"
  exit 1
fi

Sources

1. ZeroPath technical writeup
2. GitHub Security Advisory GHSA-2m7h-5m38-vhh4
3. Patchstack advisory
4. CVE Details entry
5. Wiz vulnerability database
6. SecAlerts summary
7. WordPress.org plugin page
8. Podlove Publisher GitHub