{
 "id": "WPSEC-2026-2920",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2920/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2920/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2920/index.md",
 "title": "PowerPress Podcasting plugin by Blubrry <= 11.18.2 - Authenticated (Contributor+) Path Traversal to Limited Arbitrary File Read via Chapter Image URL",
 "description": "The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Path Traversal via the episode chapter image URL (and the chapters URL) in all versions up to, and including, 11.18.2, due to the plugin turning any URL that contains the uploads base URL into a local file path with a plain string replacement and reading it from disk with no directory traversal check or confinement to the uploads folder. The chapter image is then copied into a publicly accessible uploads folder. This makes it possible for authenticated attackers, with Contributor-level access and above, to copy readable server files with a .jpg, .jpeg or .png name from outside the intended location, including uploads folders that are otherwise protected, into a public folder and then download them.",
 "plugin": {
  "slug": "powerpress",
  "name": "PowerPress Podcasting plugin by Blubrry",
  "full_name": "PowerPress Podcasting plugin by Blubrry",
  "wordpress_org": "https://wordpress.org/plugins/powerpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/powerpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/powerpress"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.18.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.18.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.18.3",
 "remediation": "Update to 11.18.3 or later.",
 "fix_released": "2026-11-10T15:05:01+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:10:00.706008+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2920/",
  "https://plugins.svn.wordpress.org/powerpress/tags/11.18.3/",
  "https://wordpress.org/plugins/powerpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/powerpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}