A missing authorization flaw in the PowerPress Podcasting plugin lets an attacker access protected data or perform actions without proper credentials, exploiting incorrectly configured access controls. The weakness is a classic missing authorization risk (CWE‑862), and the CVSS score of 5.4 indicates a moderate risk of misuse.

The flaw affects the Blubrry Podcasting PowerPress Podcasting plugin versions up to and including 11.18.0. Users running any instance of that plugin at or below this version are vulnerable.

The EPSS score is not available, but the CVSS of 5.4 shows moderate severity. The vulnerability is not listed in CISA’s KEV catalog. Attackers can likely reach the vulnerable endpoints over the web by sending crafted requests to the plugin’s administrative URLs. Because no authentication is needed to exercise the privilege escalation, a remote attacker can read or modify podcast data once access is achieved.