CVE-2026-97354
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
- Score
- CVSS 3.1 4.1 Medium
- Status
- Deferred - contact@wpscan.com
- Published
- 2026-10-07
- Last modified
- 2026-10-07
- Weaknesses
- CWE-918
Affected products
References
- https://wpscan.com/vulnerability/473239c2-0b66-466b-98ac-391dad2853b9/
