This vulnerability resides in the Podlove Podcast Publisher WordPress plugin prior to version 4.5.3, where non‑ceasing operations such as creating or deleting contributors, groups, or roles lack proper nonce validation. Because the plugin does not confirm legitimate requests, an attacker can forge an HTTP request that results in the creation of rogue records or the deletion of legitimate ones. The flaw enables an attacker to modify the podcast publication environment by inserting or removing entries without the knowledge of a legitimate administrator, thereby potentially disrupting content delivery and compromising the integrity of the publishing setup. The weakness is a classic example of Cross‑Site Request Forgery backed by insufficient access controls.

Any installation of the Podlove Podcast Publisher WordPress plugin with a version earlier than 4.5.3 is susceptible. Administrators who have access to the plugin’s administrative interface are potential targets when they visit a maliciously crafted URL while authenticated.

The CVSS score is 4.3, but the EPSS score is < 1%, indicating a low probability of exploitation at the time of this report. The vulnerability is not included in the CISA KEV catalog. Exploitation requires an administrator to visit a forged page, suggesting a moderate attack vector that is realistic in typical social engineering scenarios. Once the administrator is tricked, the attacker can create or remove records, potentially breaching confidentiality or integrity of the publishing workflow.