# PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Cross-Site Request Forgery to Diagnostics Email Sending with Session Cookie Exposure

- **ID:** WPSEC-2026-2498
- **Plugin:** PowerPress Podcasting plugin by Blubrry (`powerpress`), https://wordpress.org/plugins/powerpress/
- **Affected versions:** all versions before 11.18.2
- **Fixed in:** 11.18.2 (Update to 11.18.2 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/powerpress
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2498/

## Description

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Cross-Site Request Forgery via the diagnostics email feature in all versions up to, and including, 11.18.0. This is due to missing nonce validation on the GET request that sends the diagnostics report, which also accepts an additional CC address. Starting with version 11.16.0, the report also contains the raw request headers, including the Cookie and Authorization headers. This makes it possible for unauthenticated attackers to have the diagnostics report sent to an address they control, which in affected versions includes the victim's session cookies, granted they can trick a site administrator into performing an action such as clicking on a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2498/
- https://plugins.svn.wordpress.org/powerpress/tags/11.18.2/
- https://wordpress.org/plugins/powerpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2498/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.