CVE-2025-10147: 
WordPress vulnerability analysis and mitigation

CVE-2025-10147 is a critical arbitrary file upload vulnerability in the Podlove Podcast Publisher plugin for WordPress, caused by missing file type validation in the move_as_original_file function. It affects all versions up to and including 4.2.6, allowing unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability was published on September 23, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type): the move_as_original_file function in lib/model/image.php (line 465) performs no validation of the uploaded file's type or extension before saving it to the server (Plugin Trac). Because no authentication is required to trigger this code path, a remote, unauthenticated attacker can send a crafted HTTP request to upload a malicious file (e.g., a PHP web shell) directly to the WordPress site's server. The attack vector is network-accessible, requires no privileges or user interaction, and has low complexity, making it trivially exploitable (Wordfence, ZeroPath).

Successful exploitation allows an unauthenticated attacker to upload arbitrary files — including PHP web shells — to the WordPress server, which can lead to full remote code execution. This poses a severe risk to the entire hosting environment: an attacker could achieve complete server compromise, exfiltrate sensitive data (including WordPress database credentials), deface the website, or leverage the compromised server as a pivot point for further attacks against internal infrastructure (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Podlove Podcast Publisher plugin version ≤ 4.2.6 using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/podlove-podcasting-plugin-for-wordpress).
2. Identify the vulnerable endpoint: Locate the HTTP endpoint or API route that invokes the move_as_original_file function in lib/model/image.php, which handles file upload operations without authentication.
3. Craft malicious upload request: Prepare a PHP web shell file (e.g., shell.php) and craft an HTTP POST request targeting the vulnerable file upload endpoint, bypassing any client-side restrictions.
4. Upload the malicious file: Submit the crafted request without any authentication credentials. Due to the absence of server-side file type validation, the server accepts and stores the PHP file in a web-accessible directory.
5. Achieve remote code execution: Access the uploaded web shell via its URL (e.g., https://target.com/wp-content/uploads/shell.php) and execute arbitrary OS commands on the server, enabling data exfiltration, privilege escalation, or lateral movement (ZeroPath, GitHub PoC).

• Network: Unexpected HTTP POST requests to WordPress endpoints associated with the Podlove plugin's file upload functionality from unauthenticated sources; outbound connections from the web server to unknown external IPs following file upload activity.
• File System: Presence of PHP files (e.g., .php, .phtml, .php5) in WordPress upload directories (wp-content/uploads/) or plugin directories that are not expected media files; newly created files with web shell signatures (e.g., eval(, base64_decode(, system(, passthru().
• Logs: Web server access logs showing POST requests to Podlove plugin endpoints from unauthenticated users, followed by GET requests to newly created PHP files in upload directories; WordPress debug logs showing unexpected file write operations.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM) such as bash, curl, wget, or python executing system commands.

The primary remediation is to update the Podlove Podcast Publisher plugin to a version beyond 4.2.6, which includes the fix applied in changeset 3364994 (Plugin Changeset). If an immediate update is not possible, consider temporarily disabling the plugin to eliminate the attack surface. Additional hardening measures include deploying a Web Application Firewall (WAF) to block suspicious file upload requests, restricting web server write permissions to upload directories, and configuring the server to deny execution of PHP files within upload directories (e.g., via .htaccess rules) (Wordfence, ENISA EUVD).

Wordfence, the assigning CNA, published a weekly WordPress vulnerability report covering this CVE for the week of September 22–28, 2025, highlighting it as a critical unauthenticated file upload issue (Wordfence Blog). ZeroPath published a dedicated technical blog post analyzing the vulnerability (ZeroPath). The vulnerability was also referenced in CISA's weekly vulnerability bulletin and picked up by national CERTs including INCIBE (Spain) and CCN-CERT, indicating broad awareness within the security community (CISA Bulletin).