Cross-Site Request Forgery Vulnerability in Podlove Podcast Publisher Plugin for WordPress

CVE-2025-1383

Summary

The Podlove Podcast Publisher plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), which can lead to unauthorized deletion of episode transcripts. The vulnerability stems from inadequate nonce validation within the ajax_transcript_delete() function, allowing attackers to exploit this by tricking a site administrator into executing a malicious request. This poses a serious security risk to WordPress sites using the plugin, as unauthenticated users can potentially manipulate data with minimal user intervention.

References