CVE-2026-16099

Executive Summary

CVE-2026-16099 is a high-severity arbitrary file deletion vulnerability in the Podlove Podcast Publisher plugin for WordPress, affecting all plugin versions up to and including 4.5.3. An authenticated attacker with contributor-level access or higher can exploit insufficient file path validation in the create_link_item function, combined with a PHP object injection (POP chain) primitive, to delete arbitrary files on the web server — most notably wp-config.php, which can easily escalate to full remote code execution and site takeover. The vulnerability is unpatched at the time of this writing, carries a CVSS v3.1 score of 8.8 (High), and is not yet listed in the CISA KEV catalog; no publicly available exploit code was identified during this analysis.

Technical Analysis

The vulnerable component resides in the Podlove Podcast Publisher plugin, a popular WordPress extension used to manage podcast feeds, episode metadata, and link items. The NVD description identifies two cooperating weakness mechanisms that together create the arbitrary file deletion primitive.

Primary flaw — Insufficient path validation in create_link_item. The create_link_item function processes a file path supplied through the plugin's administrative or editorial workflows. The function fails to adequately validate the file path — no canonicalization check, directory allow-list enforcement, or containment verification is performed. As a result, a path that traverses outside the intended upload/link-item directory can be passed to the file deletion routine. This is a classic arbitrary file deletion flaw: the input path is trusted rather than constrained to an expected prefix, enabling an attacker to reference sensitive files such as wp-config.php, theme files, or other PHP files within the WordPress installation root. Notably, this allows an attacker with contributor-level access (the lowest content-authoring role that can create posts) to reach the affected functionality — no administrator privileges are required.

Secondary mechanism — Insecure deserialization (CWE-502) and POP chain. The NVD description explicitly maps this vulnerability to CWE-502 (Deserialization of Untrusted Data). A viable property-oriented programming (POP) chain exists entirely within the plugin's own codebase: the class Podlove\ImageCache\GenerationGuard implements a __destruct() method that invokes wp_delete_file() with a file path that is attacker-controlled and populated through unserialize(). Because __destruct() is invoked automatically whenever the object is garbage-collected or goes out of scope during request teardown, an attacker who can supply a crafted serialized PHP object to any input that reaches unserialize() can trigger deletion of an arbitrary path. The gadget is self-contained (a "callable gadget chain" inside the plugin), which means no external library or framework gadget collection is required.

When chained, the attack works as follows: the attacker submits a serialized object representing Podlove\ImageCache\GenerationGuard, with the target file path (for example, ../../wp-config.php) set as an object property. The vulnerable code path deserializes this object, the class' destructor fires during cleanup, and wp_delete_file() removes the target file. The deletion of wp-config.php is especially impactful: WordPress treats an absent or unreadable configuration file as an uninstalled installation and redirects to the setup wizard, at which point the attacker can complete the installation and point the site at a database server under their control. This yields full remote code execution against the web application, and frequently against the underlying hosting environment.

Attack surface. The vulnerability is remotely reachable over the network (AV:N), requires no user interaction (UI:N), and only requires low-privileged access (PR:L) — a contributor account. The preconditions are modest for a WordPress site that allows open user registration or has many low-privilege editors. No network-level signature for the underlying serialized payload exists in default WAF rule sets, and no patch, vendor advisory, or workaround has been published for this CVE as of the assessment date. EPSS scoring is pending, so exploit-probability modeling cannot be performed at this time.

Exploitation Scenarios

No public PoC or exploit code was identified; the following attack chain is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance / target identification. The attacker fingerprints internet-facing WordPress sites for the Podlove Podcast Publisher plugin. Plugin presence and version can typically be confirmed from publicly served plugin assets, changelog files, or HTML markers referencing the plugin's static resources (e.g., the plugin's scripts, stylesheets, or feed endpoints). Sites running version 4.5.3 or earlier are candidates. The attacker then identifies a way to obtain a contributor-level account: open registration on the target site, credentials from prior breaches, or weak-password guessing against editor/contributor accounts.

2. Flaw trigger. Using the contributor session, the attacker invokes the plugin's link-item creation workflow, which routes the submitted file path into create_link_item. Instead of a legitimate link-item media path, the attacker supplies a path traversal-style reference to a sensitive file (e.g., wp-config.php in the site root). Simultaneously, the attacker crafts a serialized PHP payload that instantiates Podlove\ImageCache\GenerationGuard with the chosen target path embedded as an object property. Because input validation is insufficient, the path is accepted without canonicalization or containment checks, and the serialized data reaches unserialize().

3. Payload execution. During request processing, the deserialized GenerationGuard object is destroyed. The __destruct() method executes wp_delete_file() with the attacker-controlled path, deleting the target file. The deletion itself is the exploitation outcome: no code execution is required at this stage. If wp-config.php is deleted, WordPress transitions to its setup/install state on the next request.

4. Post-exploitation impact. With wp-config.php gone, the attacker follows the WordPress installation wizard and reconfigures the site to use a database server the attacker controls (e.g., a remote MySQL instance with attacker-supplied credentials). Because WordPress configuration includes database host, username, password, and prefix, the attacker can subsequently inject arbitrary content, create malicious plugins or themes, or leverage the setup-generated configuration to write files — achieving remote code execution. In environments where PHP files are writable by the web server user — the default on shared hosting and many managed WordPress platforms — the attacker gains shell-level access, which can pivot to the broader hosting account, adjacent sites, and any databases reachable from the server.

The attack is low-complexity (AC:L) from the attacker's perspective: the discovered POP chain eliminates the need to locate external gadgets, and the file deletion outcome is deterministic rather than probabilistic.

Impact Assessment

The vulnerability is scored CVSS v3.1 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The subscores reflect severe impact across all three security objectives:

• Confidentiality (High): Achievement of remote code execution enables full read access to the WordPress database (including user credentials, PII, and payment-related records), the filesystem, and adjacent hosted applications.
• Integrity (High): An attacker who reaches RCE can modify site content, inject backdoors, replace themes/plugins, and alter database contents.
• Availability (High): Arbitrary file deletion alone already enables denial-of-service by removing critical files; RCE compounds this with the ability to destroy or ransom the entire site and hosting account. The CSRF-style and UI:N scoring is consistent with a single crafted request from an authenticated low-privilege user.

Blast radius. Any WordPress site running Podlove Podcast Publisher ≤ 4.5.3 is in scope. The plugin is a semi-niche but widely deployed podcasting tool with a global user base across media, education, and enterprise content teams, meaning the realistic blast radius spans publisher-driven websites, corporate communications properties, and media company online presences. Because the same hosting account frequently contains multiple sites, a successful compromise may expose co-tenanted applications and databases. The S:U scope component indicates the compromise is constrained to the vulnerable component's security scope (the web application and its platform), but in practice WordPress RCE frequently equals server compromise on shared and single-tenant hosting alike.

Exploit maturity. At the time of writing: no public PoC, no Nuclei template, no exploit code, no CISA KEV listing, and no EPSS score. Patch confidence is 0/4 — no tracked source has published a fix. This profile indicates a window of elevated risk once weaponized PoC material emerges, since the technical preconditions (a self-contained POP chain, contributor-level auth, and a deterministic deletion primitive) make weaponization straightforward for a moderately skilled attacker.

Detection Guidance

Detection should focus on three observable layers: (1) file deletion events targeting sensitive WordPress paths, (2) inbound/outbound HTTP requests carrying serialized PHP object payloads referencing the Podlove gadget class, and (3) WordPress behavioral anomalies such as a site transitioning to install/setup mode or a sudden loss of wp-config.php. The rules below are written against these observables and use only identifiers disclosed in the NVD description (create_link_item, Podlove\ImageCache\GenerationGuard, wp_delete_file, wp-config.php). Tune thresholds to your environment's baseline before enabling in blocking mode.

Sigma Rule

title: WordPress wp-config.php Deletion via Podlove Podcast Publisher (CVE-2026-16099)
id: 7b2f99c1-1609-4a2e-bcde-16099a1b2c3d
status: experimental
description: Detects file deletion events targeting wp-config.php, the primary impact primitive of CVE-2026-16099 arbitrary file deletion in the Podlove Podcast Publisher WordPress plugin.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16099
author: Valters IT Threat Intelligence
date: 2026/05/15
logsource:
    product: linux
    category: file_delete
detection:
    selection_wp_config:
        TargetFilename|endswith:
            - '/wp-config.php'
            - '/wp-config-sample.php'
    selection_web_root:
        TargetFilename|contains:
            - '/wp-content/'
            - '/www/'
            - '/html/'
    condition: selection_wp_config and selection_web_root
level: high
falsepositives:
    - Legitimate WordPress migrations or manual maintenance deleting the configuration file
    - Backup scripts rotating wp-config.php artifacts
fields:
    - User
    - process.name
    - TargetFilename
    - host

YARA Rule

rule podlove_cve_2026_16099_generationguard_popchain
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects PHP web shells, log artifacts, or uploaded payloads referencing the Podlove\\ImageCache\\GenerationGuard deserialization gadget chain used in CVE-2026-16099."
        cve = "CVE-2026-16099"
        cwe = "CWE-502"
        date = "2026-05-15"
    strings:
        $gadget_class = "Podlove\\ImageCache\\GenerationGuard" ascii wide
        $delete_func  = "wp_delete_file" ascii wide
        $destructor   = "__destruct" ascii wide
        $link_item    = "create_link_item" ascii wide
        $serialized   = "O:" ascii
        $config_file  = "wp-config.php" ascii wide
    condition:
        filesize < 2MB and
        (
            ($gadget_class and $delete_func and $destructor) or
            ($gadget_class and $serialized) or
            ($link_item and $config_file and $delete_func)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Podlove Podcast Publisher CVE-2026-16099 PHP Object Injection Attempt Inbound"; flow:established,to_server; http.request_body; content:"GenerationGuard"; nocase; http.request_body; content:"wp_delete_file"; nocase; http.request_body; content:"O:"; classtype:web-application-attack; reference:cve,2026-16099; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-16099; sid:202616099; rev:1;)

The rule matches HTTP request bodies that simultaneously contain a serialized PHP object marker, the GenerationGuard class name, and a reference to wp_delete_file — the minimal combination required for the POP chain to function. Because serialized payloads are often base64-encoded, pair this rule with a complementary rule matching the class name in Authorization, Cookie, or POST body parameters after decoding, or deploy the rule in an environment with HTTP normalization enabled.

Elastic Detection

file where event.module == "endpoint" and event.dataset == "endpoint.events.file"
    and event.action in ("deletion", "delete")
    and file.name == "wp-config.php"

Supplementary process-based EQL to catch deletion commands issued by the web server user:

process where event.action in ("exec", "start")
    and process.executable in ("/usr/bin/rm", "/bin/rm", "/usr/bin/unlink", "/bin/unlink")
    and process.args : "*wp-config.php*"

Splunk SPL Query

File-system monitoring query (Linux auditd or Sysmon):

(index=linux sourcetype=linux_audit OR index=windows sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
    ("wp-config.php")
    AND (eventtype=file_delete OR EventCode=23 OR "unlink" OR "delete")
| stats count min(_time) max(_time) by host, user, file_path, CommandLine, src_ip
| where count >= 1
| sort - _time

Web-log query for serialized gadget delivery:

index=proxy OR index=web
    ("GenerationGuard" OR "Podlove\ImageCache")
    AND ("wp_delete_file" OR "O:")
| stats count by src_ip, uri, http_method, user_agent, status
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,">
    <rule id="571676" level="12">
        <if_sid>554</if_sid>
        <regex>wp-config\.php</regex>
        <description>CVE-2026-16099 - WordPress wp-config.php deletion detected (possible Podlove Podcast Publisher arbitrary file deletion).</description>
        <mitre>
            <id>T1190</id>
            <id>T1485</id>
        </mitre>
        <group>pci_dss_11.5,gpg13_4.13,</group>
    </rule>
</group>

This rule triggers on Wazuh syscheck file-deletion events (base rule 554) where the deleted file name contains wp-config.php. Verify that syscheck is enabled on the WordPress web root and that report_deleted is set to yes in ossec.conf.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patched version, or advisory was identified from any tracked source. The plugin remains vulnerable up to and including version 4.5.3. Until a fixed release is published, treat the plugin as actively dangerous if the site has any contributor-level accounts.

1. Immediate mitigations (do these first):

• Disable or remove the Podlove Podcast Publisher plugin on all internet-facing WordPress instances. If podcast publishing is business-critical, isolate the plugin to a staging instance or restrict it behind an allow-listed network/VPN with administrative-only access.
• If removal is not possible, set the WordPress configuration file to immutable on Linux: chattr +i /path/to/wp-config.php (and consider chattr +i on the wp-content/plugins and wp-content/themes PHP files). This blocks deletion even by a compromised web process. Note: remove the immutable flag during legitimate maintenance windows.
• Audit all accounts with contributor-level access or higher. Disable open user registration immediately (Settings > General > Membership). Enforce strong passwords and MFA for all editor/contributor/administrator accounts.
• Deploy the Suricata and Sigma rules above at the perimeter and host levels. Add WAF rules that block POST/GET requests containing the serialized markers O: combined with GenerationGuard or wp_delete_file.
• Enable file integrity monitoring (Wazuh/FIM, Tripwire, AIDE) on the WordPress root with immediate alerting for wp-config.php and core file deletions.

2. Patch / upgrade steps:

• No patch exists today. Subscribe to the plugin's official WordPress.org update feed and Podlove vendor release channels so that a fixed version (expected to be > 4.5.3, likely released as 4.5.4 or later) is applied within hours of publication.
• Before upgrading to the fixed release, take a full backup (files + database) and test the update in a staging replica of production.
• In the interim, if in-house capability permits and licensing allows, apply a hotfix to the vulnerable code path: add strict path validation in create_link_item so that paths are canonicalized and contained within the intended directory, and replace any direct use of unserialize() with safe decoding (e.g., json_decode or a strict allow-listed deserialization with allowed_classes => false).

3. Long-term hardening:

• Adopt a least-privilege role model: WordPress contributor roles open a meaningful attack surface in every plugin that fails to enforce capability checks; minimize the number of low-privilege accounts and review them quarterly.
• Keep the WordPress core, all plugins, and themes updated; enforce a patching SLA of under 72 hours for public-facing sites.
• Run the web application on a hardened platform with a read-only web root for non-upload paths, and ensure DISALLOW_FILE_EDIT is defined in wp-config.php.
• Maintain off-site, versioned backups with tested recovery procedures — deletion-based attacks are only catastrophic when restores are untested.
• Monitor CISA KEV, FIRST EPSS, and Wordfence/WPScan feeds for updates on CVE-2026-16099; if the CVE is added to KEV or an EPSS score appears, reassess exposure and expedite the mitigation timeline.

References

1. NVD Entry — CVE-2026-16099: https://nvd.nist.gov/vuln/detail/CVE-2026-16099
2. WordPress Plugin Directory — Podlove Podcast Publisher (official distribution channel; monitor for patched release): https://wordpress.org/plugins/podlove-podcasting-plugin/
3. MITRE CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
4. CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed; monitor for status changes): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat-actor campaign status: No known threat-actor campaigns, exploit-in-the-wild evidence, or public PoC was identified at the time of writing. The vulnerability's combination of a self-contained POP chain, contributor-level access requirement, and deterministic arbitrary file deletion makes it a credible candidate for inclusion in WordPress-focused exploit toolkits once a fix or PoC is disclosed. SOC teams should treat any observed deletion of wp-config.php on a site running the affected plugin as a confirmed compromise indicator and initiate incident response immediately.