{"id":"CVE-2026-121762","published":"2026-11-07T10:17:11.083","lastModified":"2026-11-07T19:17:23.820","description":"Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.18.0.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-18-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A CSRF vulnerability in Blubrry Podcasting PowerPress (versions through 11.18.0) allows attackers to trick authenticated users into performing unintended actions on the podcasting plugin, such as modifying podcast settings or publishing content, by exploiting the user's active session.","exploitability":"Exploitation requires social engineering to诱导 a logged-in administrator or authorized user to click a malicious link or visit a crafted page while authenticated; no authentication bypass or complex conditions are needed beyond user interaction.","blast_radius":"Successful exploitation could lead to unauthorized modification of podcast content, injection of malicious media links, or full compromise of podcast publishing workflows, potentially affecting audience trust and site integrity.","remediation":"Upgrade to PowerPress Podcasting version 11.18.1 or later, which includes a CSRF token fix; if upgrading is not immediately possible, disable the affected administrative endpoints or enforce strict SameSite cookie attributes for session cookies.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","web","auth-bypass","podcasting"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:53:27.613Z"}}