Unauthenticated Broken Access Control in PowerPress Podcasting Plugin by WordPress
CVE-2026-104387

7.2HIGH

Key Information:

Vendor

WordPress
Status
Powerpress Podcasting
Vendor
CVE Published:
6 October 2026

What is CVE-2026-104387?

The PowerPress Podcasting Plugin for WordPress is susceptible to an unauthenticated broken access control vulnerability. This issue allows unauthorized users to access and manipulate resources, potentially leading to data exposure or unintended application behavior. Users of PowerPress Podcasting versions up to 11.17.9 should prioritize reviewing their configurations and apply necessary patches to mitigate risks associated with unauthorized access.

Affected Version(s)

PowerPress Podcasting <= 11.17.9

References

https://patchstack.com/database/wordpress/plugin/powerpre...
vdb-entry

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

b1ue0cean | Patchstack Bug Bounty Program
.