CVE-2025-10147 is a critical vulnerability in the Podlove Podcast Publisher WordPress plugin caused by the lack of file type validation in the 'move_as_original_file' function. This flaw permits unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability affects all versions up to and including 4.2.6. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the web server hosting the Podlove Podcast Publisher plugin, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Podlove Podcast Publisher plugin or restricting file upload permissions to mitigate risk. Monitor official vendor channels for updates and apply patches promptly once released.