Seriously Simple Podcasting CVE-2026-112834

The target must be a WordPress site running the Castos Seriously Simple Podcasting plugin at version 3.17.0 or earlier, reachable over the network. The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction are required, so default configurations are exploitable. The practical limiting factor is impact scope, not access: the flaw yields only low-level confidentiality disclosure (C:L, no I/A impact), meaning an attacker gains unauthorized read access to plugin-controlled data rather than code execution or site takeover. The input does not name the specific endpoint/action lacking the capability check, so the exact data exposed is not specified in available sources.

This is a genuine but moderate-priority issue, best characterized as a high-reach-but-low-impact flaw rather than a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms it is remotely and unauthenticatedly exploitable at low complexity against default WordPress installs, which raises reachability; however, the impact profile is narrow - C:L/I:N/A:N means limited confidentiality disclosure only, with no integrity or availability effect, consistent with a Missing Authorization (CWE-862) read-type access-control gap. No EPSS score, KEV listing, or public POC was provided in the input, so there is no positive signal of active exploitation or imminent weaponization. SSVC-style reasoning: exploitation status is 'none observed,' technical impact is 'partial,' and while the low complexity makes it potentially automatable, the limited payoff (information exposure) reduces attacker incentive. Net: patch in normal cycle rather than emergency, prioritizing internet-facing WordPress sites running the plugin. Note the discovery/disclosure is single-sourced to Patchstack, so affected-version and impact details are not independently corroborated.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running Seriously Simple Podcasting (≤3.17.0), invoking a plugin endpoint or action that fails to enforce an authorization/capability check. Because the access-control level is incorrectly configured, the attacker retrieves plugin-managed data they should not be able to see. No public exploit code was identified at time of analysis, and the CVSS low attack complexity means no special timing or conditions are needed.