{"id":"CVE-2026-125782","kind":"vulnerability","aliases":["CVE-2026-125782"],"related":[],"title":"PowerPress Podcasting WordPress plugin: missing authorization check through 11.18.2","description":"Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.2.","summary":"The PowerPress Podcasting WordPress plugin by Blubrry is missing an authorization check, so access control is not enforced as intended. The sources do not say what data or actions an attacker gains beyond that.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","powerpress","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed PowerPress version in the WordPress admin plugin list or in the plugin's `powerpress.php` header.\n- Compare against the affected range: all versions through `11.18.2`.","fix":"- PowerPress Podcasting: unknown; the sources do not name a fixed version.","status":"open","published_at":"2026-11-11T13:17:23+00:00","first_seen_at":"2026-11-11T13:27:15+00:00","triaged_at":"2026-11-11T13:29:44+00:00","updated_at":"2026-11-11T13:29:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:44Z","model":"claude-haiku-5-5","output":{"fix":"- PowerPress Podcasting: unknown; the sources do not name a fixed version.","reach":"internet","title":"PowerPress Podcasting WordPress plugin: missing authorization check through 11.18.2","impact":"medium","summary":"The PowerPress Podcasting WordPress plugin by Blubrry is missing an authorization check, so access control is not enforced as intended. The sources do not say what data or actions an attacker gains beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","powerpress","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted plugin functions on the site","analyst_note":"Find the exact missing check, the required privilege, and a fixed PowerPress version from the NVD entry or the Wordfence/plugin changelog.","how_to_check":"- Check the installed PowerPress version in the WordPress admin plugin list or in the plugin's `powerpress.php` header.\n- Compare against the affected range: all versions through `11.18.2`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the PowerPress Podcasting plugin up to version 11.18.2 are in the stated range. The sources do not describe which roles or settings make a site exposed, so the exact conditions are unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4552,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125782':12A,15A '-2026':11A,14A '11.18.2':9A,79C 'access':35B,68C 'action':50B 'affect':73C 'allow':64C 'attack':52B 'author':6A,32B,56C 'beyond':54B 'blubrri':28B,59C 'check':7A,33B 'configur':67C 'control':36B,69C 'cve':10A,13A 'data':48B 'enforc':39B 'exploit':65C 'gain':53B 'host':20B 'incorrect':66C 'intend':41B 'issu':72C 'levels.this':71C 'miss':5A,30B,55C 'n/a':77C 'packag':16B 'plugin':4A,26B 'podcast':2A,24B,60C,62C,75C 'powerpress':1A,17B,23B,61C,63C,74C 'say':46B 'secur':70C 'self':19B 'self-host':18B 'sourc':43B 'vulner':57C 'wordpress':3A,21B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the PowerPress Podcasting plugin up to version 11.18.2 are in the stated range. The sources do not describe which roles or settings make a site exposed, so the exact conditions are unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","powerpress","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125782':12A,15A '-2026':11A,14A '11.18.2':9A 'author':6A 'check':7A 'cve':10A,13A 'miss':5A 'plugin':4A 'podcast':2A 'powerpress':1A 'wordpress':3A","search_b":"'access':35B 'action':50B 'attack':52B 'author':32B 'beyond':54B 'blubrri':28B 'check':33B 'control':36B 'data':48B 'enforc':39B 'gain':53B 'host':20B 'intend':41B 'miss':30B 'packag':16B 'plugin':26B 'podcast':24B 'powerpress':17B,23B 'say':46B 'self':19B 'self-host':18B 'sourc':43B 'wordpress':21B,25B","search_c":"'11.18.2':79C 'access':68C 'affect':73C 'allow':64C 'author':56C 'blubrri':59C 'configur':67C 'control':69C 'exploit':65C 'incorrect':66C 'issu':72C 'levels.this':71C 'miss':55C 'n/a':77C 'podcast':60C,62C,75C 'powerpress':61C,63C,74C 'secur':70C 'vulner':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125782","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125782","severity":null,"published_at":"2026-11-11T13:17:23+00:00","modified_at":"2026-11-11T13:17:23+00:00","first_seen_at":"2026-11-11T13:27:15+00:00","fetched_at":"2026-11-11T13:27:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}