PowerPress Podcasting plugin by Blubrry <= 11.18.3 - Authenticated (Contributor+) Missing Authorization to Hosted Media Deletion
- ID
- WPSEC-2026-3082
- Plugin
- PowerPress Podcasting plugin by Blubrry (powerpress)
- Affected
- all versions before 11.18.4
- Remediation
- Update to 11.18.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- PowerPress Podcasting plugin by Blubrry on WPSec AttackSurface
- Fix released
- Published
Description
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to unauthorized deletion of hosted media via the 'powerpress-jquery-media-delete' action in all versions up to, and including, 11.18.3. This is due to the action only checking for the edit_posts capability and a nonce that the plugin's media picker gives to any user with that capability, while sending the DELETE request to the Blubrry API with the site's stored Blubrry credentials. The handler also does not check that the file is an unpublished file listed in the program, and it puts the 'delete' and 'blubrryProgramKeyword' values into the API request path without encoding. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete any media file in the site's Blubrry hosting program, including published podcast episodes.
References
- https://wpsec.com/vuln/WPSEC-2026-3082/
- https://plugins.svn.wordpress.org/powerpress/tags/11.18.4/
- https://wordpress.org/plugins/powerpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS