PowerPress Podcasting CVE-2026-97354

Requires an authenticated WordPress account with the contributor role or higher on a site running the PowerPress Podcasting plugin (versions 11.13.12 through before 11.17.11), and the attacker must supply a media URL that the plugin fetches server-side, where the fetch logic follows HTTP redirects to attacker-chosen destinations without validating them. Limiting factors: exploitation is gated by a valid authenticated session (not anonymous), impact is limited to reading/reaching internal services (confidentiality-oriented SSRF, no direct write or code execution indicated), and sites that do not grant untrusted users contributor access have a substantially reduced attack surface.

This is a moderate, not urgent, priority. The CVSS 3.1 base score of 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) reflects a network-reachable, low-complexity SSRF that requires authentication and yields only limited confidentiality impact with a scope change (reaching internal services). Publicly available exploit code exists (WPScan), which raises the practical likelihood of opportunistic abuse, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. A notable internal inconsistency: the CVSS vector specifies PR:H (high privileges) while the description states the flaw is exploitable by 'contributor role and above,' which is a LOW-privileged authenticated WordPress role - the vendor's PR:H appears to overstate the privilege barrier, meaning real-world exploitability is likely EASIER than the 4.1 score suggests. No SSVC decision data, EPSS probability, or KEV status was provided, so automatability and exploitation-maturity cannot be derived from the input. Net: a real but bounded risk best handled via normal patch cycles, with priority raised on multi-author/membership sites where untrusted users hold contributor accounts.

An attacker who holds (or registers/obtains) a WordPress contributor account on a site running PowerPress before 11.17.11 submits a media URL that the plugin fetches server-side; because redirect destinations are not validated, the attacker points it at an internal address and causes the server to follow a redirect into the internal network. A public proof-of-concept is referenced by WPScan, and given AV:N/AC:L the request is simple to craft, though a valid contributor-level login is required.