Vulnerability · Published Aug 12, 2026 · Assigned by WPScan
CVE-2026-16294Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL
High 7.1
In plain English
A high-severity server-side request forgery in PowerPress Podcasting plugin by Blubrry from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 78.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | PowerPress Podcasting plugin by Blubrry | 0 – before 11.17.1 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- https://wpscan.com/vulnerability/9363aaff-40d6-41c0-8edd-cbf671240ad2/ exploit, vdb-entry, technical-description