Arbitrary file deletion via object injection

PHP object injection in Podlove Podcast Publisher before 4.5.4 allows remote authenticated users to delete arbitrary files via shownotes requests. The shownotes REST handlers create_item and create_link_item accepted client-set unfurl_data and other assigned properties, and the model layer persisted them with maybe_serialize until unserialization could populate Podlove\ImageCache\GenerationGuard with an attacker-controlled lock path. Contributor-level or higher access to edit shownotes is required, and the built-in destructor chain deletes the chosen path through wp_delete_file, enabling arbitrary file deletion and possible code execution if a critical PHP file is removed.