CVE-2025-66060: Castos Simple Podcasting Auth Bypass Flaw

CVE-2025-66060 Overview

CVE-2025-66060 is a Missing Authorization vulnerability [CWE-862] in the Seriously Simple Podcasting plugin for WordPress, developed by Craig Hewitt and maintained by Castos. The flaw stems from incorrectly configured access control checks in plugin functionality. Attackers can reach protected functionality over the network without authentication or user interaction. The issue affects all versions of Seriously Simple Podcasting up to and including 3.13.0. Exploitation results in a limited integrity impact on the WordPress site while confidentiality and availability remain unaffected.

Critical Impact
Unauthenticated attackers can invoke plugin functionality that should require authorization, modifying podcast-related data on affected WordPress installations.

Affected Products

Castos Seriously Simple Podcasting (WordPress plugin)
All versions from n/a through 3.13.0
WordPress sites running the seriously-simple-podcasting plugin

Discovery Timeline

2025-11-21 - CVE-2025-66060 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66060

Vulnerability Analysis

The Seriously Simple Podcasting plugin exposes one or more actions that lack proper capability or nonce verification. When a request reaches these endpoints, the plugin executes the requested operation without confirming that the caller holds the required WordPress role or capability. This is a textbook Broken Access Control weakness classified under [CWE-862] Missing Authorization.

Because the plugin runs inside the WordPress request lifecycle, the vulnerable handlers are reachable through standard admin-ajax.php, REST API routes, or admin-post endpoints exposed by the plugin. The attack requires no privileges and no user interaction, and it can be executed remotely against any site running an affected version.

The impact is scoped to integrity. An attacker can trigger state-changing operations exposed by the plugin, but the flaw does not directly disclose sensitive data or crash the site. The EPSS probability for exploitation is 0.241%.

Root Cause

The root cause is the absence of current_user_can() capability checks and, in some code paths, missing nonce validation via check_ajax_referer() or wp_verify_nonce(). Handlers assume the caller is authorized based on request context rather than verifying identity and privilege server-side.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint on a target WordPress site. Because authentication is not required, the request can originate from any internet host. The Patchstack advisory documents the specific vulnerable endpoints and parameters. See the Patchstack Vulnerability Report for endpoint-level detail.

Detection Methods for CVE-2025-66060

Indicators of Compromise

Unexpected POST requests to wp-admin/admin-ajax.php referencing plugin actions from the seriously-simple-podcasting namespace originating from unauthenticated sessions.
Requests to plugin REST routes under /wp-json/ associated with Seriously Simple Podcasting that lack a valid X-WP-Nonce header.
Unexplained modifications to podcast episodes, feed settings, or plugin options in the WordPress database.

Detection Strategies

Enable WordPress audit logging to capture option changes and plugin-initiated actions with the originating user ID and IP address.
Alert on HTTP requests reaching plugin endpoints where the session cookie is absent or the user ID resolves to 0 (unauthenticated).
Compare installed plugin versions across the estate against the fixed release and flag any host still running <= 3.13.0.

Monitoring Recommendations

Forward web server access logs and WordPress activity logs to a central SIEM or data lake for correlation.
Baseline normal traffic patterns to admin-ajax.php and alert on volume spikes from single source IPs.
Track plugin file integrity to detect tampering following suspected exploitation attempts.

How to Mitigate CVE-2025-66060

Immediate Actions Required

Inventory all WordPress sites running the Seriously Simple Podcasting plugin and identify installs at version 3.13.0 or earlier.
Update the plugin to the latest patched release published by Castos through the WordPress plugin repository.
Review recent podcast content, plugin settings, and user accounts for unauthorized changes.

Patch Information

Castos has addressed the issue in a release subsequent to 3.13.0. Administrators should upgrade via the WordPress admin console under Plugins > Installed Plugins, or by using WP-CLI. Refer to the Patchstack Vulnerability Report for the fixed version reference.

Workarounds

Temporarily deactivate the Seriously Simple Podcasting plugin on any site where patching is not immediately feasible.
Restrict access to wp-admin/admin-ajax.php and plugin REST routes at the web application firewall for unauthenticated sources where podcast functionality is not public.
Enforce virtual patching rules that block requests targeting the vulnerable plugin actions until the update is applied.

bash

# Update the plugin using WP-CLI
wp plugin update seriously-simple-podcasting

# Verify the installed version is above 3.13.0
wp plugin get seriously-simple-podcasting --field=version

# If patching is delayed, deactivate the plugin as a workaround
wp plugin deactivate seriously-simple-podcasting