CVE-2025-58204: Podlove Podcast Publisher Open Redirect

CVE-2025-58204 Overview

CVE-2025-58204 is an open redirect vulnerability in the Podlove Podcast Publisher plugin for WordPress, developed by Eric Teubert. The flaw affects all versions up to and including 4.2.5. Attackers can craft malicious URLs that leverage the trusted plugin domain to redirect victims to attacker-controlled sites. This behavior enables phishing campaigns that exploit user trust in the legitimate WordPress site. The vulnerability is classified under [CWE-601] URL Redirection to Untrusted Site.

Critical Impact
Attackers can weaponize trusted WordPress sites running Podlove Podcast Publisher to redirect users to phishing pages, credential harvesters, or malware distribution infrastructure.

Affected Products

Podlove Podcast Publisher plugin for WordPress (versions through 4.2.5)
WordPress sites using podlove-podcasting-plugin-for-wordpress
Eric Teubert-maintained plugin distributions

Discovery Timeline

2025-08-27 - CVE-2025-58204 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58204

Vulnerability Analysis

The Podlove Podcast Publisher plugin contains an open redirect flaw that fails to validate destination URLs before performing HTTP redirects. Attackers craft a URL pointing to the vulnerable WordPress endpoint with a redirect parameter specifying an untrusted external destination. When a victim clicks the link, the browser first contacts the trusted WordPress domain and is then forwarded to the attacker-controlled site.

The attack requires user interaction, since the victim must click the crafted URL. However, no authentication is required to trigger the redirect, and the scope changes from the trusted site to an untrusted destination. This vulnerability primarily supports phishing operations rather than direct data theft on the WordPress host. The EPSS score is 0.196%, indicating low near-term exploitation probability in automated scans.

Root Cause

The root cause is missing or insufficient validation of a user-supplied redirect target parameter within the plugin's request handling logic. The plugin accepts a URL value from the request and issues an HTTP redirect without confirming the destination belongs to an allowlist of trusted domains. See the Patchstack Vulnerability Report for further technical detail.

Attack Vector

An unauthenticated attacker constructs a URL that references the vulnerable plugin endpoint on a WordPress site running Podlove Podcast Publisher 4.2.5 or earlier. The URL includes a redirect parameter set to an attacker-controlled domain. The attacker distributes the link via email, chat, social media, or malicious advertising. Victims see the trusted WordPress domain in the initial URL, click through, and land on a phishing or malware page.

The vulnerability manifests in the plugin's redirect handler. No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2025-58204

Indicators of Compromise

Web server access logs showing requests to Podlove plugin endpoints with external URLs in redirect-related query parameters
HTTP 301 or 302 responses from the WordPress site pointing to domains unrelated to the podcast infrastructure
Referrer headers on downstream phishing infrastructure originating from WordPress sites running Podlove
User reports of suspicious links that appear to originate from a legitimate podcast site

Detection Strategies

Parse WordPress access logs for requests to Podlove plugin routes that include URL-encoded external hostnames in query strings
Correlate outbound redirect responses against a list of expected internal destinations
Deploy web application firewall rules that flag redirect parameters containing schemes and hostnames outside the site's own domain
Monitor threat intelligence feeds for phishing kits abusing WordPress open redirects

Monitoring Recommendations

Enable verbose HTTP response logging on WordPress servers hosting the Podlove plugin
Alert on unusual spikes in 3xx redirect responses from plugin endpoints
Track user-agent and geographic patterns of clients hitting redirect URLs to identify campaign activity

How to Mitigate CVE-2025-58204

Immediate Actions Required

Inventory all WordPress installations to identify sites running Podlove Podcast Publisher version 4.2.5 or earlier
Update the plugin to a version released after 4.2.5 that addresses this issue once available from the vendor
Restrict administrative access and review recent redirect activity for signs of abuse
Notify end users and podcast subscribers about active phishing risks tied to the affected sites

Patch Information

Refer to the Patchstack Vulnerability Report for the latest fixed version guidance. Administrators should apply the patched release through the WordPress plugin update mechanism and verify the plugin version after upgrade.

Workarounds

Deploy a web application firewall rule that blocks requests to Podlove plugin endpoints containing external hostnames in redirect parameters
Temporarily disable the Podlove Podcast Publisher plugin on sites where an immediate patch cannot be applied
Implement server-level URL validation that rejects redirect targets outside the site's registered domain allowlist
Educate content teams to avoid sharing plugin-generated URLs that include redirect parameters until the patch is deployed

bash

# Example nginx rule to block external redirect parameters
location ~* /wp-content/plugins/podlove-podcasting-plugin-for-wordpress/ {
    if ($args ~* "(redirect|url|target|dest)=https?%3A%2F%2F(?!yoursite\.com)") {
        return 403;
    }
}