Security Alert Summary
The PowerPress Podcasting plugin by Blubrry contains a Server-Side Request Forgery (SSRF) issue that stems from not validating the destination of redirects when fetching a user-supplied media URL. Users with the contributor role and above can trigger requests to internal services, which may expose internal resources or data reachable from the web server.
CVE Details
- CVE ID: CVE-2026-97354
- Affected component: PowerPress Podcasting plugin by Blubrry
- Affected versions: Versions before 11.17.11 (example affected version listed: 11.13.12)
- Published: October 7, 2026 at 07:17:02 AM UTC
- Last modified: October 7, 2026 at 02:52:43 PM UTC
- CVSS v3.1: Base score 4.1 – MEDIUM; vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N - Authentication / privileges / user interaction:
- Privileges required: HIGH
- User interaction: NONE
- Attack vector: NETWORK
- Scope: CHANGED
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- CWE / weakness ID: CWE-918 (Server-Side Request Forgery)
Technical Details
The plugin fails to validate the destination of redirects when it fetches a media URL provided by a user. This allows an attacker with sufficient privileges (contributor role and above) to supply a URL that causes the server to follow redirects to internal or otherwise restricted endpoints, resulting in Server-Side Request Forgery (SSRF).
The vulnerability exists because the code that performs the fetch does not enforce checks on redirected locations or restrict destinations to allowed hosts. No specific function names or REST endpoints are provided in the available data; the description identifies the root cause as missing validation of redirect destinations when handling user-supplied media URLs.
Impact is limited to what SSRF can access from the hosting environment. According to the CVSS data, confidentiality impact is low and there is no reported integrity or availability impact. This means an attacker may be able to probe internal services or retrieve limited information reachable from the web server, but the issue is not reported as permitting code execution or site takeover based on the supplied data.
How This Could Impact Your Website
Imagine a multi-author site where the site owner manages publishing, internal staff handle content, and external contractors or contributors upload media. A contributor who can add or edit media URLs could supply a crafted URL that causes your server to request internal endpoints (for example, metadata endpoints or internal APIs). That activity could reveal internal service responses or confirm the presence of internal resources, which may include email addresses or other low-sensitivity data accessible to the server.
Realistic consequences include exposure of internal user email addresses or internal-only endpoints and an increased risk of targeted phishing or social engineering against staff if information is collected. These outcomes align with the CVSS assessment of limited confidentiality impact rather than full site compromise.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and higher-privileged roles for external users.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and server logs for unusual outbound requests or unexpected media fetches.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
