SQL Injection Vulnerability in PowerPress Podcasting Plugin by WordPress
CVE-2026-24637

8.5HIGH

Key Information:

Vendor

WordPress
Status
Powerpress Podcasting
Vendor
CVE Published:
15 June 2026

What is CVE-2026-24637?

The PowerPress Podcasting plugin for WordPress versions up to 11.15.10 is vulnerable to SQL Injection attacks. This security flaw allows attackers to manipulate SQL queries executed by the application, potentially leading to unauthorized access to sensitive data or a complete database compromise. Website administrators using this plugin are advised to review their installations and apply necessary updates to safeguard against potential exploitation.

Affected Version(s)

PowerPress Podcasting <= 11.15.10

References

https://patchstack.com/database/wordpress/plugin/powerpre...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO | Patchstack Bug Bounty Program
.