CVE-2026-97354 — PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

CVE-2026-97354

PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects PUBLISHED

Description (CNA)

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.

Affected (CNA)

Vendor / product	Versions
Unknown / PowerPress Podcasting plugin by Blubrry	affected 11.13.12 before 11.17.11

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/473239c2-0b66-466b-98ac-391dad2853b9/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.