A critical arbitrary file deletion vulnerability in the Podlove Podcast Publisher plugin allows authenticated users to delete sensitive system files, leading to potential site instability or service denial.

The plugin fails to properly validate file paths within the create_link_item function, allowing an authenticated user to perform arbitrary file deletion on the server.

The ability to delete arbitrary files on the web server can lead to severe service disruption, including the loss of core application files, configuration files, or database backups. This results in significant downtime and potential data loss. With a CVSS score of 8.8, this vulnerability poses a high risk to the availability and integrity of the hosting environment.

Immediate Action: Update the Podlove Podcast Publisher plugin to version 4.5.4 or later immediately.

Proactive Monitoring: Monitor server file system logs for unauthorized deletion attempts or unexpected changes to critical directories.

Compensating Controls: Implement file system permissions that restrict the web server user from modifying files outside of necessary directories to limit the impact of potential file-based attacks.

Public Exploit Available: No

Given the potential for permanent data loss and service disruption, upgrading to version 4.5.4 is mandatory. Organizations relying on the Podlove Podcast Publisher should prioritize this update to prevent unauthorized file system modifications and ensure the ongoing stability of their WordPress infrastructure.