The vulnerability is a cross‑site request forgery flaw in the PowerPress Podcasting plugin that allows an attacker to trigger privileged actions without user interaction, by exploiting the absence of a protective nonce. If an authenticated user visits a crafted URL, the attacker can change podcast settings or potentially upload malicious content, threatening the integrity of the hosted media. The flaw does not directly expose data but can alter publisher configuration and compromise control over podcast metadata.

Blubrry Podcasting’s PowerPress Podcasting plugin, in all releases from the earliest available version through 11.18.0, is vulnerable. The affected component is part of the WordPress plugin ecosystem and is frequently used by site owners to manage podcast feeds.

The CVSS base score of 8.8 classifies this as a high‑severity weakness, and the EPSS score is currently not available, so a quantifiable exploit probability cannot be assigned. KEV lists it as not exploited. The most likely attack vector is a CSRF attack performed by convincing a logged‑in user to visit a malicious link; no additional technical barriers or privileged conditions are described. The impact is limited to integrity and availability of podcast administration functions, but the ease of exploitation makes it a priority for remediation.