EUVD-2026-93073
GHSA-694x-76hp-xqq5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Unauthenticated network-reachable missing-authorization flaw (PR:N/AV:N/AC:L) with no confidentiality and only Low integrity/availability impact; downgraded to S:U as no cross-component scope change is described.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
AnalysisAI
Unauthorized action execution in PowerPress Podcasting (≤11.17.9) allows unauthenticated network attackers to bypass access controls with low integrity and availability impact, as the plugin fails to enforce authorization (CWE-862). Affected are WordPress sites running the plugin; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, but there is no confidentiality impact and only low integrity/availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a vulnerable PowerPress Podcasting instance (≤11.17.9) be installed and network-reachable on a WordPress site; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special plugin configuration are stated as prerequisites, so default installations exposed to the internet are reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) signals a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which for a WordPress plugin means any visitor can trigger it - a genuinely attractive profile for opportunistic mass scanning against internet-facing sites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version is identified in the available data; consult the Patchstack advisory for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress instances running PowerPress Podcasting 11.17.9 or earlier and disable or remove the plugin where business operations allow; if removal is not possible, apply WAF/virtual-patching rules to block unauthenticated requests to PowerPress endpoints, restrict access to wp-admin and plugin files by IP where feasible, and enable enhanced logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerpress Podcasting
View allSQL injection in the Blubrry PowerPress Podcasting WordPress plugin through version 11.15.10 allows authenticated users
Cross-Site Request Forgery (CSRF) in the Blubrry PowerPress Podcasting plugin for WordPress up to version 11.17.9 allows
Stored XSS in blubrry PowerPress Podcasting through version 11.15.13 permits authenticated administrators with high priv
Unauthenticated information disclosure in the Blubrry PowerPress Podcasting WordPress plugin (versions up to and includi
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today