The vulnerability is a classic CSRF flaw in the Podlove Podcast Publisher WordPress plugin. The ajax_transcript_delete() function does not properly validate the nonce field, allowing an unauthenticated attacker to craft a request that a logged‑in administrator might unknowingly execute. The consequence is the loss or alteration of transcript data, which can compromise the integrity of the podcast publishing process and potentially disrupt listeners’ access to episode information.

WordPress sites running any version of the Podlove Podcast Publisher plugin up to and including 4.2.2. The flaw is present in all installations of the plugin prior to the 4.2.3 release, regardless of other theme or plugin configurations.

The CVSS score is 4.3, rating the vulnerability as low to moderate severity. With an EPSS score of less than 1%, spontaneous exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is feasible for any attacker who can entice a site administrator to click a malicious link or submit a forged form. The lack of nonce verification means that a single click can trigger transcript deletion without further interaction, giving the attacker an immediate and destructive impact.