# Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Sensitive Information Exposure of Private and Draft Posts via podcast_episode Shortcode

- **ID:** WPSEC-2026-1376
- **Plugin:** Seriously Simple Podcasting (`seriously-simple-podcasting`), https://wordpress.org/plugins/seriously-simple-podcasting/
- **Affected versions:** all versions before 3.17.1
- **Fixed in:** 3.17.1 (Update to 3.17.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1376/

## Description

The Seriously Simple Podcasting plugin for WordPress is vulnerable to Sensitive Information Exposure via the [podcast_episode] shortcode in all versions up to, and including, 3.17.0, due to the plugin rendering the title, content, excerpt and player of any post ID passed in the 'episode' attribute without checking its post type, status or whether the current user may read it. This makes it possible for authenticated attackers with contributor-level access and above to read the content of private, draft and pending posts, and the media of non-public episodes, that belong to other users.

## References

- https://wpsec.com/vuln/WPSEC-2026-1376/
- https://plugins.svn.wordpress.org/seriously-simple-podcasting/tags/3.17.1/
- https://wordpress.org/plugins/seriously-simple-podcasting/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1376/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.