The vulnerability in Podlove Podcast Publisher versions 4.5.3 and older allows authenticated users with contributor-level access or higher to craft a malicious payload that exploits PHP Object Injection. By supplying a specially crafted ‘unfurl_data’ parameter to the create_link_item function, an attacker can populate an object that invokes the __destruct() method of Podlove\ImageCache\GenerationGuard. When that destructor runs, it calls WordPress’s wp_delete_file() with the attacker-controlled path, enabling deletion of any file on the server. Removing critical files such as wp-config.php can lead directly to remote code execution, making this flaw a serious threat to the confidentiality, integrity, and availability of the site.

The affected product is the WordPress plugin Podlove Podcast Publisher from the vendor eteubert, versions up through 4.5.3. Users who run these plugin versions and have at least contributor-level permissions are at risk; the vulnerability does not affect unauthenticated visitors.

With a CVSS score of 8.8, the flaw is of high severity, though the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authenticated access to the WordPress backend, which means an attacker must possess at least contributor credentials or compromise a user’s account. Once there, an attacker can upload or post the malicious payload via the plugin’s API or admin interface, triggering file deletion. The potential to delete arbitrary pages and configuration files makes this a high‑risk scenario for remote code execution if the appropriate files are targeted.