{
 "id": "WPSEC-2026-1376",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1376/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1376/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1376/index.md",
 "title": "Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Sensitive Information Exposure of Private and Draft Posts via podcast_episode Shortcode",
 "description": "The Seriously Simple Podcasting plugin for WordPress is vulnerable to Sensitive Information Exposure via the [podcast_episode] shortcode in all versions up to, and including, 3.17.0, due to the plugin rendering the title, content, excerpt and player of any post ID passed in the 'episode' attribute without checking its post type, status or whether the current user may read it. This makes it possible for authenticated attackers with contributor-level access and above to read the content of private, draft and pending posts, and the media of non-public episodes, that belong to other users.",
 "plugin": {
  "slug": "seriously-simple-podcasting",
  "name": "Seriously Simple Podcasting",
  "full_name": "Seriously Simple Podcasting",
  "wordpress_org": "https://wordpress.org/plugins/seriously-simple-podcasting/",
  "advisories_url": "https://wpsec.com/vuln/plugin/seriously-simple-podcasting/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.17.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.17.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.17.1",
 "remediation": "Update to 3.17.1 or later.",
 "fix_released": "2026-10-19T10:34:53+00:00",
 "published": "2026-10-21T13:44:54+00:00",
 "updated": "2026-10-21T13:33:40.983929+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1376/",
  "https://plugins.svn.wordpress.org/seriously-simple-podcasting/tags/3.17.1/",
  "https://wordpress.org/plugins/seriously-simple-podcasting/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}