The Podlove Podcast Publisher WordPress plugin contains an unauthenticated arbitrary file upload flaw due to missing file‑type validation in the 'move_as_original_file' function. An attacker can post any file type to the site, including executable scripts, which may lead to remote code execution or other malicious actions on the server. This weakness is classified as CWE‑434 (Unrestricted Upload of File with Insecure Type).

The vulnerability affects eteubert's Podlove Podcast Publisher plugin for WordPress in all releases up to and including version 4.2.6, including the 4.2.6 release. Users running the plugin on their sites in these versions are exposed.

With a CVSS score of 9.8, the flaw is a critical vulnerability. The EPSS score of less than 1% indicates a very low current exploitation probability, and it is not listed in the CISA KEV catalog. However, because the upload does not require authentication, the attack vector is straightforward: an unauthenticated user can upload a malicious file directly to the server, exploiting the lack of file‑type checks. The consequence can be full control over the web application or the underlying server, depending on the file execution context.