EUVD-2026-92327
GHSA-x9p4-jhfp-xr52
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Missing authorization on a network endpoint needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is limited information disclosure only, so C:L with I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
AnalysisAI
Unauthenticated information disclosure in the Blubrry PowerPress Podcasting WordPress plugin (versions up to and including 11.17.9) let's remote attackers retrieve embedded sensitive data from an affected site because a function handling that data lacks a proper authorization check (CWE-862). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), no credentials or user interaction are required, but the impact is confined to confidentiality only, limited to specific embedded data rather than arbitrary site data, credentials, or any write capability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the target WordPress site have the PowerPress Podcasting plugin installed and active at version 11.17.9 or earlier, with the affected endpoint network-reachable; per CVSS PR:N/UI:N no authentication or user interaction is needed against default configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-to-moderate priority issue, not a high-severity emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data at time of analysis - the Patchstack advisory should be treated as the tracking source for a fixed release, and administrators should update PowerPress through the WordPress plugin dashboard as soon as a version later than 11.17.9 is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerpress Podcasting
View allSQL injection in the Blubrry PowerPress Podcasting WordPress plugin through version 11.15.10 allows authenticated users
Unauthorized action execution in PowerPress Podcasting (≤11.17.9) allows unauthenticated network attackers to bypass acc
Cross-Site Request Forgery (CSRF) in the Blubrry PowerPress Podcasting plugin for WordPress up to version 11.17.9 allows
Stored XSS in blubrry PowerPress Podcasting through version 11.15.13 permits authenticated administrators with high priv
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today