PowerPress <= 11.17.9 - Authenticated (Contributor+) Server-Side Request Forgery via Episode Media URL

ID

WPSEC-2026-0330

Plugin

PowerPress Podcasting plugin by Blubrry (powerpress)

Affected

all versions before 11.17.11

Remediation

Update to 11.17.11 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-918

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

PowerPress on WPSec AttackSurface

Fix released

2026-10-01

Published

2026-10-02

Description

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 11.17.9 via the episode media URL that the plugin fetches when an episode is saved to detect its file size and duration. The plugin's public-address check did not exclude the loopback range, and the fetch followed redirects and re-resolved the host name without validating each hop. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application, including services listening on the loopback interface, which can be used to query and modify information from internal services.

References

• https://wpsec.com/vuln/WPSEC-2026-0330/
• https://plugins.svn.wordpress.org/powerpress/tags/11.17.11/
• https://wordpress.org/plugins/powerpress/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS