CVE-2025-66059: Castos Seriously Simple Podcasting Flaw

CVE-2025-66059 Overview

CVE-2025-66059 is a sensitive information disclosure vulnerability in the Craig Hewitt Seriously Simple Podcasting plugin for WordPress. The flaw affects all versions of seriously-simple-podcasting from initial release through 3.13.0. Unauthenticated attackers can retrieve embedded sensitive data over the network without user interaction. The vulnerability is classified under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. Castos maintains the plugin, which is widely deployed on podcast-hosting WordPress sites. Successful exploitation impacts confidentiality but does not affect integrity or availability.

Critical Impact
Unauthenticated remote attackers can retrieve embedded sensitive system information from vulnerable WordPress sites running Seriously Simple Podcasting 3.13.0 or earlier.

Affected Products

Castos Seriously Simple Podcasting <= 3.13.0
WordPress installations with the seriously-simple-podcasting plugin enabled
All prior plugin releases up to and including version 3.13.0

Discovery Timeline

2025-11-21 - CVE-2025-66059 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66059

Vulnerability Analysis

The vulnerability stems from improper access controls on plugin endpoints that expose embedded sensitive data. Seriously Simple Podcasting includes system information within responses accessible to unauthorized users. The issue is categorized under [CWE-497], which covers scenarios where an application places sensitive data into a location reachable by actors outside the intended trust boundary.

Attackers exploit the flaw by issuing standard HTTP requests to affected plugin endpoints. No authentication, privileges, or user interaction is required. The plugin returns data that should remain restricted to administrators or internal components. This exposure can support reconnaissance for follow-on attacks against the WordPress host, its plugins, or connected services.

The EPSS score is 0.271% with a percentile of 18.969, reflecting low observed exploitation activity to date. However, the trivial exploitation path and low complexity make targeted abuse straightforward for opportunistic scanners.

Root Cause

The root cause is missing authorization on plugin functionality that returns embedded system or configuration data. The plugin does not verify the requesting user's capability before returning the sensitive payload. This design flaw enables anonymous retrieval of data intended for privileged contexts.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to the WordPress site hosting the vulnerable plugin. Because the request requires no credentials or interactive steps, mass-exploitation via automated scanners is feasible. Refer to the Patchstack Vulnerability Report for endpoint-level technical detail.

Detection Methods for CVE-2025-66059

Indicators of Compromise

Unauthenticated HTTP GET requests to Seriously Simple Podcasting plugin endpoints from unfamiliar IP addresses or scanning infrastructure.
Web server access logs showing repeated requests targeting wp-content/plugins/seriously-simple-podcasting/ resources.
Response bodies containing configuration data, internal paths, or system information returned to anonymous clients.

Detection Strategies

Inventory WordPress sites and identify installations running seriously-simple-podcasting version 3.13.0 or earlier.
Alert on anonymous access patterns to plugin endpoints not intended for public consumption.
Correlate outbound reconnaissance signatures with subsequent authenticated activity on the same host.

Monitoring Recommendations

Enable verbose WordPress and web server logging to capture request URIs, source IPs, and response sizes.
Deploy web application firewall rules to flag requests probing known plugin paths.
Monitor plugin update advisories from Patchstack and Castos for indicators of active exploitation.

How to Mitigate CVE-2025-66059

Immediate Actions Required

Update Seriously Simple Podcasting to a version above 3.13.0 as soon as the vendor publishes a fixed release.
Audit WordPress sites for plugin version and disable the plugin if a patch is not yet available.
Review web server logs for prior unauthenticated access to plugin endpoints and assess data exposure.

Patch Information

At time of publication, the vulnerability affects versions up to and including 3.13.0. Consult the Patchstack Vulnerability Report and the Castos plugin repository for the latest fixed release and upgrade instructions.

Workarounds

Deactivate the seriously-simple-podcasting plugin until a patched version is installed.
Apply web application firewall rules restricting anonymous access to plugin endpoints exposing sensitive data.
Restrict plugin endpoints via server-side access controls in .htaccess or NGINX configuration to trusted IPs.

bash

# Configuration example
# NGINX rule to restrict access to Seriously Simple Podcasting endpoints
location ~* /wp-content/plugins/seriously-simple-podcasting/ {
    allow 10.0.0.0/8;
    deny all;
}