Description
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
Published: 2026-10-06
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to PowerPress Podcasting functionality and data via unauthenticated access
Action: Patch Now
AI Analysis

Impact

The vulnerability represents an unauthenticated broken access control flaw that allows attackers to bypass normal restrictions and potentially alter or delete podcast content and configuration. The weakness is identified as CWE‑862. The impact is unauthorized access to PowerPress functionality and data on vulnerable WordPress sites.

Affected Systems

The affected product is the WordPress PowerPress Podcasting plugin from Blubrry, version 11.17.9 and older. Sites running any of these releases are susceptible.

Risk and Exploitability

The CVSS score of 7.2 indicates high severity. The EPSS score of <1% implies a low probability of exploitation. While not listed in the CISA KEV catalog, the flaw is unauthenticated, implying that any internet‑facing WordPress installation could be targeted. The attack vector is inferred to be remote via the web interface; the precise method of exploitation is not detailed in the description.

Generated by OpenCVE AI on October 7, 2026 at 04:51 UTC.

Remediation

Vendor Solution

Update the WordPress PowerPress Podcasting plugin to the latest available version (at least 11.17.11).

OpenCVE Recommended Actions

  • Update the PowerPress Podcasting plugin to version 11.17.11 or later.
  • Restrict or disable publicly exposed endpoints that allow podcast configuration or media management, ensuring only authenticated administrators can access them.
  • Implement additional access controls in WordPress, such as two‑factor authentication for administrators and limiting REST API exposure.

Generated by OpenCVE AI on October 7, 2026 at 04:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Blubrry
Blubrry powerpress Podcasting
Wordpress-extensions
Wordpress-extensions powerpress Podcasting
Vendors & Products Blubrry
Blubrry powerpress Podcasting
Wordpress-extensions
Wordpress-extensions powerpress Podcasting

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
Title WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L'}

Subscriptions

Blubrry Powerpress Podcasting
Wordpress-extensions Powerpress Podcasting
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:28.112Z

Reserved: 2026-10-02T00:22:13.105Z

Link: CVE-2026-104387

cve-icon Vulnrichment

Updated: 2026-10-06T10:28:18.464Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:38.077

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-104387

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:00:12Z

Weaknesses