{"id":"CVE-2026-121762","kind":"vulnerability","aliases":["CVE-2026-121762"],"related":[],"title":"PowerPress WordPress plugin: cross-site request forgery through version 11.18.0","description":"Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.18.0.","summary":"PowerPress is a WordPress podcasting plugin from Blubrry. A flaw in it lets an attacker trick a logged-in site administrator's browser into submitting actions the administrator did not intend.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"powerpress","fixed":[],"affected":"<= 11.18.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["auth-required","package","podcasting","powerpress","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed PowerPress version in the WordPress admin Plugins page or with `wp plugin get powerpress --field=version`\n- Confirm whether the installed version is `11.18.0` or earlier","fix":null,"status":"open","published_at":"2026-11-07T10:17:11+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:20+00:00","updated_at":"2026-11-07T10:49:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T10:48:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PowerPress WordPress plugin: cross-site request forgery through version 11.18.0","impact":"medium","summary":"PowerPress is a WordPress podcasting plugin from Blubrry. A flaw in it lets an attacker trick a logged-in site administrator's browser into submitting actions the administrator did not intend.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","powerpress","podcasting"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker forces an administrator's browser to change plugin settings","analyst_note":"Find the vendor advisory or the NVD entry for the fixed version and which PowerPress actions are protected by the missing token check.","how_to_check":"- Check the installed PowerPress version in the WordPress admin Plugins page or with `wp plugin get powerpress --field=version`\n- Confirm whether the installed version is `11.18.0` or earlier\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the PowerPress Podcasting plugin at version 11.18.0 or earlier are described as affected. The sources do not say which plugin settings or pages are reachable, so exposure beyond the installed version is unknown. Sites that do not run PowerPress can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4231,"output_tokens":532,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or the NVD entry for the fixed version and which PowerPress actions are protected by the missing token check.","search":"'-121762':14A,17A '-2026':13A,16A '11.18.0':11A,83C 'action':52B 'administr':47B,54B 'affect':77C 'allow':71C 'attack':40B 'auth':20B 'auth-requir':19B 'blubrri':33B,66C 'browser':49B 'cross':5A,59C,72C 'cross-sit':4A,58C 'csrf':63C 'cve':12A,15A 'flaw':35B 'forgeri':8A,62C 'forgery.this':75C 'intend':57B 'issu':76C 'let':38B 'log':44B 'logged-in':43B 'n/a':81C 'packag':22B 'plugin':3A,31B 'podcast':23B,30B,67C,69C,79C 'powerpress':1A,18A,24B,26B,68C,70C,78C 'request':7A,61C,74C 'requir':21B 'site':6A,46B,60C,73C 'submit':51B 'trick':41B 'version':10A 'vulner':64C 'wordpress':2A,25B,29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the PowerPress Podcasting plugin at version 11.18.0 or earlier are described as affected. The sources do not say which plugin settings or pages are reachable, so exposure beyond the installed version is unknown. Sites that do not run PowerPress can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["powerpress"],"ptokens":["powerpress"],"labels":["authrequired","high","package","podcasting","powerpress","wordpress"],"campaign_type":null,"search_a":"'-121762':14A,17A '-2026':13A,16A '11.18.0':11A 'cross':5A 'cross-sit':4A 'cve':12A,15A 'forgeri':8A 'plugin':3A 'powerpress':1A,18A 'request':7A 'site':6A 'version':10A 'wordpress':2A","search_b":"'action':52B 'administr':47B,54B 'attack':40B 'auth':20B 'auth-requir':19B 'blubrri':33B 'browser':49B 'flaw':35B 'intend':57B 'let':38B 'log':44B 'logged-in':43B 'packag':22B 'plugin':31B 'podcast':23B,30B 'powerpress':24B,26B 'requir':21B 'site':46B 'submit':51B 'trick':41B 'wordpress':25B,29B","search_c":"'11.18.0':83C 'affect':77C 'allow':71C 'blubrri':66C 'cross':59C,72C 'cross-sit':58C 'csrf':63C 'forgeri':62C 'forgery.this':75C 'issu':76C 'n/a':81C 'podcast':67C,69C,79C 'powerpress':68C,70C,78C 'request':61C,74C 'site':60C,73C 'vulner':64C","first_public_at":"2026-11-07T10:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121762","severity":null,"published_at":"2026-11-07T10:17:11+00:00","modified_at":"2026-11-07T10:17:11+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121762:2099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121762","severity":null,"published_at":"2026-11-07T10:49:36+00:00","modified_at":"2026-11-07T10:49:36+00:00","first_seen_at":"2026-11-07T10:49:36+00:00","fetched_at":"2026-11-07T10:49:36+00:00","note":"NVD/Patchstack (CVSS 8.8, AV:N/PR:N/UI:R) list PowerPress <= 11.18.0 as CSRF. No vendor advisory, fixed version, or list of affected actions found; wordpress.org plugin page (modified 2026-11-03) gave no changelog in the text I read. Fix left unknown; check the plugin changelog for a release newer than 11.18.0. Nothing verified, since only NVD and a third-party database were read. No exploitation or PoC found. Earlier PowerPress CSRFs were fixed in 11.14 and 11.17.11.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-121762","https://patchstack.com/database/wordpress/plugin/powerpress/vulnerabilities"]}],"documents":[{"id":94908,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121762","title":"NVD CVE-2026-121762","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":94909,"url":"https://patchstack.com/database/wordpress/plugin/powerpress/vulnerabilities","title":"Patchstack PowerPress vulnerability history","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}