CVE-2026-16099

Name of the Vulnerable Software and Affected Versions Podlove Podcast Publisher versions prior to 4.5.4

Description Insufficient file path validation in the create link item() function allows authenticated attackers with contributor-level access or higher to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as wp-config.php, are removed. The issue is exploitable via PHP Object Injection through the unfurl data parameter, utilizing a POP chain (a sequence of gadgets used to execute arbitrary code during unserialization) within the PodloveImageCacheGenerationGuard class, where the destruct() method calls wp delete file() using a path controlled by the attacker.

Recommendations Update Podlove Podcast Publisher to version 4.5.4 or later.