The CVSS 8.8 score for this Podlove Podcast Publisher vulnerability dramatically undersells the actual risk by measuring only the file deletion entry point while ignoring two distinct, low-complexity paths from contributor-level access to full remote code execution.
The first path is brutal and well-established: the create_link_item() function allows contributor-level users to delete arbitrary files. Deleting wp-config.php forces WordPress into its installation wizard state, where you can re-initialize the application with attacker-controlled database credentials. This is post-exploitation tradecraft that's been documented for over a decade — it doesn't require understanding PHP internals, and it works reliably across standard WordPress hosting configurations.
The second path is more elegant but equally dangerous: the Podlove\ImageCache\GenerationGuard class contains a __destruct() magic method that directly invokes wp_delete_file() with attacker-controlled data flowing through PHP's unserialize() function. This POP chain lives entirely within the plugin — no external WordPress code, no complex gadget discovery required. The class persists in actively-maintained plugin versions because magic methods don't announce themselves in code reviews, don't appear in call graphs, and survive refactoring cycles precisely because nobody audits what happens when an object of that class appears in a deserialization sink.
What makes this critical is the access-to-impact ratio. Contributor-level access is the lowest privileged authenticated role in WordPress — they can write drafts but cannot modify themes, upload files, or execute code. This vulnerability shatters that boundary entirely, granting server-level compromise to a role typically provisioned for guest submissions on editorial platforms.
The blast radius extends further than single-site analysis suggests. In multi-site WordPress installations or shared hosting environments, contributor accounts often have write access across sites, and configuration patterns are frequently shared. The deterministic, scriptable nature of the wp-config.php deletion path means this becomes automatable the moment a reliable proof-of-concept is public.
Compensating controls beyond removing the plugin are limited in the short term. Contributors aren't flagged in SIEM rules, aren't categorized as high-privilege users, and rarely receive second-factor enforcement. The temporal gap between disclosure and defender understanding — the time it takes organizations to recognize that contributor accounts now represent a critical tier — creates compounding exposure debt that grows daily post-disclosure, independent of whether a patch exists. Prioritize patching this vulnerability and treat any contributor-level account as a privileged identity requiring monitoring until the patch is verified deployed.