What is the CVSS score of CVE-2026-13729?

CVE-2026-13729 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-13729?

Yes, a public proof-of-concept exploit is available for CVE-2026-13729. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-13729?

Yes, a patch is available for CVE-2026-13729. Update the affected software to the latest version immediately.

Podlove Podcast Publisher CVE-2026-13729

EUVD-2026-51703 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-01 WPScan

GHSA-2c9c-r2jq-hgq6

WordPress CSRF Podlove Podcast Publisher Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Attacker needs no credentials (PR:N) but requires active admin interaction with a crafted page (UI:R); impact is integrity-only at low severity, with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:45 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

MEDIUM 4.3

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

AnalysisAI

CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) identifies the root cause: WordPress plugins are expected to generate and validate cryptographic nonces tied to user sessions on all state-changing administrative actions, preventing browsers from being silently weaponized by third-party pages. Podlove Podcast Publisher omits this check on certain administrative create and delete endpoints, meaning any authenticated admin session can be abused by a forged cross-origin form submission. The affected component is the Podlove Podcast Publisher plugin for WordPress, identified by CPE cpe:2.3:a:unknown:podlove_podcast_publisher:*:*:*:*:*:*:*:*, covering the full version range from 0 up to (not including) 4.5.3. The vendor field in the CPE is listed as 'unknown,' which limits automated scanner matching accuracy.

RemediationAI

Upgrade Podlove Podcast Publisher to version 4.5.3 or later, which adds proper nonce validation to the affected administrative actions. The patch is confirmed available per the WPScan advisory (https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/). As an interim compensating control, instruct administrators to log out of the WordPress admin dashboard when not actively performing administrative tasks, and to avoid clicking unsolicited links while an admin session is active - this directly breaks the required UI:R attack condition. A WAF rule blocking cross-origin POST requests to wp-admin endpoints for this plugin's action hooks would provide additional defense, though it may break legitimate external integrations that rely on admin-side API calls. No exact patch version beyond '4.5.3' is confirmed from the available references.