CVE-2026-16099
Received Received - Intake

Arbitrary File Deletion in Podlove Podcast Publisher WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). A viable POP chain exists within the plugin itself via Podlove\ImageCache\GenerationGuard, whose __destruct() method invokes wp_delete_file() with an attacker-controlled file path populated through unserialization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-16099
EUVD
EUVD-2026-59854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
podlove podlove_podcast_publisher to 4.5.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Podlove Podcast Publisher plugin for WordPress has a flaw in its file handling. The create_link_item function fails to properly validate file paths, allowing authenticated attackers with contributor access or higher to delete arbitrary files on the server. This can lead to remote code execution if critical files like wp-config.php are removed. The vulnerability is exacerbated by a PHP object injection (POP) chain within the plugin itself.

Detection Guidance

Check for unauthorized file deletions or suspicious activity in WordPress logs. Review plugin versions and look for the Podlove Podcast Publisher plugin up to 4.5.3. Monitor for unexpected wp-config.php or other critical file deletions.

Impact Analysis

If you use the Podlove Podcast Publisher plugin on your WordPress site, an attacker could delete important files, disrupt your website, or take full control of it. This includes deleting configuration files, media, or other critical data. The attack requires only contributor-level access, making it easier for unauthorized users to cause significant damage.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or data loss, which may violate GDPR, HIPAA, or other compliance standards. If sensitive user data is exposed or deleted, organizations could face legal penalties, reputational damage, and loss of trust. Immediate patching is recommended to maintain compliance.

Mitigation Strategies

Update the Podlove Podcast Publisher plugin to the latest version beyond 4.5.3. Remove or disable the plugin if not needed. Restrict contributor-level access to only trusted users. Review server logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16099. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart