EUVD-2026-92306
GHSA-47m9-m546-ghxq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Remote CSRF needs no attacker privileges (PR:N) but requires tricking an authenticated user (UI:R); impacts are limited (C/I/A:L) and confined to the vulnerable app (S:U).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
Articles & Coverage 1
AnalysisAI
Cross-Site Request Forgery (CSRF) in the Blubrry PowerPress Podcasting plugin for WordPress up to version 11.17.9 allows remote attackers to force a logged-in user, typically an administrator, to perform unintended actions by tricking them into interacting with a crafted link or malicious page, due to missing CSRF token validation. Exploitation requires user interaction (UI:R) and an active authenticated session, but no public exploit code is currently identified. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user with sufficient privileges (typically an administrator) to be actively logged in and to interact with attacker-controlled content (UI:R) - e.g., clicking a crafted link or visiting a malicious page in the same browser session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity CSRF flaw (CVSS 7.1, CWE-352) reported by Patchstack affecting all PowerPress Podcasting versions up to and including 11.17.9. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data; monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-17-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running Blubrry PowerPress version 11.17.9 or earlier and consider temporarily disabling the plugin if podcast publishing can be paused, or at minimum restrict administrative access to trusted IPs and enforce multi-factor authentication for all administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerpress Podcasting
View allSQL injection in the Blubrry PowerPress Podcasting WordPress plugin through version 11.15.10 allows authenticated users
Unauthorized action execution in PowerPress Podcasting (≤11.17.9) allows unauthenticated network attackers to bypass acc
Stored XSS in blubrry PowerPress Podcasting through version 11.15.13 permits authenticated administrators with high priv
Unauthenticated information disclosure in the Blubrry PowerPress Podcasting WordPress plugin (versions up to and includi
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today