{"id":"CVE-2026-112834","kind":"vulnerability","aliases":["CVE-2026-112834"],"related":[],"title":"Seriously Simple Podcasting WordPress plugin: missing authorization check through 3.17.0","description":"Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.","summary":"The Seriously Simple Podcasting WordPress plugin by Castos has a missing authorization check, so a request can reach functionality its caller should not be allowed to use. The sources say the flaw affects all versions through 3.17.0 and do not describe the exact data or actions exposed.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","seriously-simple-podcasting","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get seriously-simple-podcasting --field=version`\n- unknown for anything beyond the version, since the sources do not describe the affected endpoint","fix":"- Update Seriously Simple Podcasting to a version later than `3.17.0`; the sources do not name the exact fixed release\n- unknown for other mitigations","status":"open","published_at":"2026-10-20T15:17:14+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:46+00:00","updated_at":"2026-10-25T04:24:46+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:24:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update Seriously Simple Podcasting to a version later than `3.17.0`; the sources do not name the exact fixed release\n- unknown for other mitigations","reach":"internet","title":"Seriously Simple Podcasting WordPress plugin: missing authorization check through 3.17.0","impact":"medium","summary":"The Seriously Simple Podcasting WordPress plugin by Castos has a missing authorization check, so a request can reach functionality its caller should not be allowed to use. The sources say the flaw affects all versions through 3.17.0 and do not describe the exact data or actions exposed.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","seriously-simple-podcasting","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin actions","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version, the affected endpoint and whether an account is required.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get seriously-simple-podcasting --field=version`\n- unknown for anything beyond the version, since the sources do not describe the affected endpoint","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Seriously Simple Podcasting plugin at version 3.17.0 or earlier are in scope. Sites that do not have the plugin installed can skip it. The sources do not say which roles or settings are needed to reach the flawed check.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3317,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112834':13A,16A '-2026':12A,15A '3.17.0':10A,65B,104C 'access':92C 'action':74B 'affect':61B,97C 'allow':53B,88C 'author':7A,40B,77C 'caller':49B 'casto':36B,80C 'check':8A,41B 'configur':91C 'control':93C 'cve':11A,14A 'data':72B 'describ':69B 'exact':71B 'exploit':89C 'expos':75B 'flaw':60B 'function':47B 'host':20B 'incorrect':90C 'issu':96C 'levels.this':95C 'miss':6A,39B,76C 'n/a':102C 'packag':17B 'plugin':5A,28B,34B 'podcast':3A,24B,32B,83C,87C,100C 'reach':46B 'request':44B 'say':58B 'secur':94C 'self':19B 'self-host':18B 'serious':1A,22B,30B,81C,85C,98C 'seriously-simple-podcast':21B,84C 'simpl':2A,23B,31B,82C,86C,99C 'sourc':57B 'use':55B 'version':63B 'vulner':78C 'wordpress':4A,25B,27B,33B 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Seriously Simple Podcasting plugin at version 3.17.0 or earlier are in scope. Sites that do not have the plugin installed can skip it. The sources do not say which roles or settings are needed to reach the flawed check.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112834","severity":null,"published_at":"2026-10-20T15:17:14+00:00","modified_at":"2026-10-21T11:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}