Description

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-12T06:18:55.203Z",
  "pubdate": "2026-08-12T06:18:55.203Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the PowerPress Podcasting plugin by Blubrry for WordPress in versions prior to 11.17.1. The flaw stems from insufficient validation of the Podcast Episode URL setting prior to executing server-side HTTP requests. This security deficiency allows malicious actors authenticated with a role as low as Contributor to leverage the application hosting the WordPress instance as a proxy to dispatch arbitrary network requests toward internal services and local network infrastructure that would normally be inaccessible from the external perimeter. Successful exploitation compromises the confidentiality and integrity of internal network segments, potentially exposing sensitive metadata endpoints, internal APIs, or backend services residing behind the organizational firewall. The risk implications are significant as unauthorized internal scanning and data exfiltration can be achieved using legitimate administrative or editor-level plugin functionalities exposed to low-privileged accounts.",
  "technicalDetails": "The vulnerability is rooted in an input validation failure within the Podcast Episode URL setting handling logic of the PowerPress Podcasting plugin by Blubrry. When processing configuration data or episode creation parameters, the plugin fails to sanitize, parse, or enforce a strict whitelist or schema validation on the supplied URL strings before initiating outbound server-side requests. Consequently, when the application attempts to fetch or validate the user-supplied Podcast Episode URL, it executes a server-side request using the underlying operating system or HTTP client libraries against the designated target.\nThe attack vector requires an authenticated user with a Contributor role or higher within the WordPress installation. Because the Contributor role is typically permitted to draft posts and interact with specific plugin features, an attacker can manipulate the vulnerable Podcast Episode URL setting by injecting arbitrary Uniform Resource Identifiers pointing to internal loopback addresses (e.g., 127.0.0.1 or localhost), internal subnet ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16.x.x), or cloud metadata services (e.g., 169.254.169.254) which are commonly exposed in cloud-hosted environments.\nThe step-by-step attack flow proceeds as follows: First, the low-privileged attacker authenticates to the WordPress dashboard with a Contributor-level account. Second, the attacker crafts a malicious HTTP request targeting the plugin's episode configuration interface, supplying a crafted internal URL within the Podcast Episode URL parameter. Third, upon saving or processing the episode settings, the PowerPress Podcasting plugin triggers a server-side request to the malicious URL without verifying the destination safety. Fourth, the server initiates the network connection, interacts with the internal service or metadata API, and potentially reflects the response or error states back to the application or logs, or allows the attacker to infer internal network topology and service availability through response timing and content behavior.\nThe affected component is the Podcast Episode URL configuration handler within the PowerPress Podcasting plugin by Blubrry for all versions prior to 11.17.1. The vulnerability exposes the network stack of the hosting server to untrusted inputs originating from low-privileged administrative contexts, bypassing network segmentation and boundary defenses."
}