CVE-2026-104407
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The PowerPress Podcasting plugin for WordPress (versions up to 11.17.9) contains a Cross-Site Request Forgery (CSRF) vulnerability that may allow unauthorized actions on behalf of a logged-in user.
Risk Assessment
An attacker can trick an administrator into performing unwanted operations in the WordPress panel, potentially leading to configuration changes or other impacts. User interaction is required.
Recommendation
Update the PowerPress Podcasting plugin to a version newer than 11.17.9. Additionally, enforce CSRF protections such as tokens and educate users about phishing.
Other vulnerabilities in PowerPress Podcasting
See all- CVE-2026-97354Medium
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
- CVE-2026-104387High
PowerPress Podcasting plugin in versions up to and including 11.17.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-104388Medium
The PowerPress Podcasting WordPress plugin contains a missing authorization vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 11.17.9.
- CVE-2026-16294High
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
- CVE-2026-16293Medium
The PowerPress Podcasting plugin by Blubrry for WordPress before version 11.16.11 does not sanitize and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- CVE-2026-24637High
SQL Injection vulnerability in PowerPress Podcasting versions <= 11.15.10 allows attackers to inject malicious SQL queries.
- CVE-2025-64201Medium
Cross-Site Request Forgery (CSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Cross Site Request Forgery. This issue affects PowerPress Podcasting: from n/a through <= 11.13.12.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS