# Unauthenticated Arbitrary File Upload Vulnerability **URL:** \ **Category:** Podlove Publisher\ **Created:** [September 27, 2025, 6:45am UTC](https://community.podlove.org/t/unauthenticated-arbitrary-file-upload-vulnerability/3500 "2025-09-27T06:45:33Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ericteubert](https://community.podlove.org/user_avatar/community.podlove.org/ericteubert/32/1568_2.png) [@ericteubert](https://community.podlove.org/u/ericteubert)\ **Post date:** [September 27, 2025, 6:45am UTC](https://community.podlove.org/t/unauthenticated-arbitrary-file-upload-vulnerability/3500/1 "2025-09-27T06:45:33Z")
A critical exploit in Podlove Publisher has been discovered and is actively being exploited in the wild. If you run Podlove Publisher on your site, you must update immediately and check if your system has already been compromised. - Official vulnerability record: [CVE-2025-10147](https://www.cve.org/CVERecord?id=CVE-2025-10147) - Announcement on Mastodon: [Podlove: "⚠️ Make sure your Podlove Publisher is updated to…" - Fosstodon](https://fosstodon.org/@podlove/115262045089697398) ## What you need to know - The exploit is _fixed_ in v4.2.7 of Podlove Publisher. - Since publication of the vulnerability, there has been a widespread attack to find instances that had not been patched immediately. You need to check if your system has been compromised. ## How to find out if you were attacked If you read german, here’s a really good [blog post](https://blog.uberspace.de/2025/09/was-wir-gegen-podlove-exploits-tun/) by uberspace, including what mitigations worked for them. Here’s the short and concise version for anyone just trying to fix their own WordPress: - upgrade if you haven’t (and you really really need to) - look for php files in any `/wp-content/cache/podlove/`subdirectories. If you find any, you’ve been compromised. - look for suspicious php files in `/wp-admin/` like `3wF3e0.php`If you find any, you’ve been compromised. ## Now what? If your site has been compromised, the best option is to use a backup (files _and_ database) from before the attacks (and then immediately update the Publisher plugin because your backup will have an outdated version). If that’s not an option: - Delete the whole `/wp-content/cache/podlove/`directory. It’s just caches that can be deleted any time. - Delete any suspicious files as described above. - Use any of the popular security plugins to scan for malicious files or content. - Check database malicious activity, like added admin accounts - Change all passwords ## Be Prepared Consider enabling [auto-updates for plugins](https://wordpress.org/documentation/article/plugins-themes-auto-updates/#enable-auto-updates-for-plugins). The time between exploit publication and start of attacks was less than 24 hours, not enough to find out about a patch and update manually. I am now aware of better ways to handle the upgrade path for severe security patches, but you’re safest with auto-updates. And backups. Backups are mandatory in any case. Speed matters. Automated updates and frequent backups are your best defense. Stay safe, Eric ---
**Author:** ![MoritzGiessmann](https://community.podlove.org/user_avatar/community.podlove.org/moritzgiessmann/32/1710_2.png) [@MoritzGiessmann](https://community.podlove.org/u/MoritzGiessmann)\ **Post date:** [September 27, 2025, 9:25am UTC](https://community.podlove.org/t/unauthenticated-arbitrary-file-upload-vulnerability/3500/2 "2025-09-27T09:25:43Z")
Thanks for this! Maybe add that passwords (DB and others) need to be changed since they might have been compromised. Is there an estimation how impactful this hack could be? I mean do they have full access to the machine? How far did it go? Is there any information on what was achieved with this hack? What did the hacker use it for? Filesharing? Bitcoin? ---
**Author:** ![ericteubert](https://community.podlove.org/user_avatar/community.podlove.org/ericteubert/32/1568_2.png) [@ericteubert](https://community.podlove.org/u/ericteubert)\ **Post date:** [September 27, 2025, 11:42am UTC](https://community.podlove.org/t/unauthenticated-arbitrary-file-upload-vulnerability/3500/3 "2025-09-27T11:42:05Z")
> [@MoritzGiessmann](#): > > Maybe add that passwords (DB and others) need to be changed since they might have been compromised. Good point, edited some. > [@MoritzGiessmann](#): > > Is there an estimation how impactful this hack could be? I mean do they have full access to the machine? How far did it go? They could upload an arbitrary PHP file and execute it. That means they could read any file on the system, and have the same edit rights as any piece of code in the WordPress system. Pretty extensive. > [@MoritzGiessmann](#): > > Is there any information on what was achieved with this hack? What did the hacker use it for? Filesharing? Bitcoin? I haven’t seen anything conclusive. Some people reported deleted files. Others traffic spikes, suggesting filesharing. ---
**Author:** ![Elisa](https://community.podlove.org/user_avatar/community.podlove.org/elisa/32/2127_2.png) [@Elisa](https://community.podlove.org/u/Elisa)\ **Post date:** [October 3, 2025, 5:25pm UTC](https://community.podlove.org/t/unauthenticated-arbitrary-file-upload-vulnerability/3500/4 "2025-10-03T17:25:09Z")
Thank you for writing about this Eric, and fixing the exploit. I discovered it once a client site had malware. Now that we’ve cleaned that up, and Podlove files had been targeted in cache, I just now noticed that a new user was added, which I have deleted. Am SO happy that your plugin exists, especially for this client, it has been how I was able to continue their website since they’re retired but still have a show. Thank you again.