PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Cross-Site Request Forgery to Diagnostics Email Sending with Session Cookie Exposure
- ID
- WPSEC-2026-2498
- Plugin
- PowerPress Podcasting plugin by Blubrry (powerpress)
- Affected
- all versions before 11.18.2
- Remediation
- Update to 11.18.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- PowerPress Podcasting plugin by Blubrry on WPSec AttackSurface
- Fix released
- Published
Description
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Cross-Site Request Forgery via the diagnostics email feature in all versions up to, and including, 11.18.0. This is due to missing nonce validation on the GET request that sends the diagnostics report, which also accepts an additional CC address. Starting with version 11.16.0, the report also contains the raw request headers, including the Cookie and Authorization headers. This makes it possible for unauthenticated attackers to have the diagnostics report sent to an address they control, which in affected versions includes the victim's session cookies, granted they can trick a site administrator into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-2498/
- https://plugins.svn.wordpress.org/powerpress/tags/11.18.2/
- https://wordpress.org/plugins/powerpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS