CVE-2026-104387 Overview
CVE-2026-104387 is a broken access control vulnerability affecting the Blubrry PowerPress Podcasting plugin for WordPress in versions up to and including 11.17.9. The flaw allows unauthenticated attackers to invoke plugin functionality that should be restricted to authorized users. The weakness is classified under CWE-862: Missing Authorization.
The vulnerability is network-exploitable with low attack complexity and requires no user interaction or authentication. Successful exploitation can impact integrity and availability of podcast-related content and configuration on affected WordPress sites.
Critical Impact
Unauthenticated attackers can reach protected plugin actions over the network, bypassing authorization checks on WordPress sites running vulnerable PowerPress versions.
Affected Products
- Blubrry PowerPress Podcasting plugin for WordPress
- Versions <= 11.17.9
- WordPress sites with the plugin enabled and reachable over the network
Discovery Timeline
- 2026-10-06 - CVE-2026-104387 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104387
Vulnerability Analysis
The vulnerability is a Missing Authorization issue in the PowerPress Podcasting plugin. The plugin exposes one or more handlers that fail to verify the caller's capability or nonce before executing privileged actions. An unauthenticated remote attacker can send crafted HTTP requests to these endpoints and trigger operations intended for authorized users.
The Patchstack advisory classifies this as Broken Access Control affecting versions through 11.17.9. The scope is marked as changed, meaning the vulnerable component can affect resources beyond its own security authority — consistent with a WordPress plugin acting on site-wide content or configuration. For technical specifics, see the Patchstack PowerPress Vulnerability Advisory.
Root Cause
The root cause is missing or insufficient authorization checks on plugin request handlers. WordPress plugins must gate state-changing actions with current_user_can() capability checks and check_ajax_referer() or wp_verify_nonce() validation. When these checks are absent or incorrectly applied, any unauthenticated visitor can invoke the handler.
Attack Vector
Exploitation is performed over the network against the WordPress site. The attacker sends HTTP requests directly to the exposed plugin endpoint — typically admin-ajax.php, a REST route, or a plugin-specific action handler — without supplying valid credentials or a session cookie. The server executes the requested action because authorization is not enforced.
No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is documented in the Patchstack advisory; no verified exploitation code is reproduced here.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104387
Indicators of Compromise
- Unauthenticated HTTP POST requests to wp-admin/admin-ajax.php referencing PowerPress actions.
- Requests to plugin REST routes under /wp-json/powerpress/ or similar from unexpected IP ranges.
- Unexpected modifications to podcast feed configuration, episode metadata, or media URLs without a corresponding admin login event.
Detection Strategies
- Inventory WordPress deployments and flag any instance running PowerPress Podcasting <= 11.17.9.
- Correlate web access logs with authentication logs to surface state-changing plugin requests that lack a preceding authenticated session.
- Deploy a web application firewall rule to alert on unauthenticated access to PowerPress action handlers.
Monitoring Recommendations
- Monitor plugin file timestamps and the WordPress options table for unexpected changes to PowerPress settings.
- Alert on new or modified RSS feed URLs and media enclosures published by the site.
- Track outbound requests from the WordPress server that could indicate attacker-controlled resources being referenced in feeds.
How to Mitigate CVE-2026-104387
Immediate Actions Required
- Upgrade the Blubrry PowerPress Podcasting plugin to a version later than 11.17.9 as soon as a fixed release is available from the vendor.
- Audit WordPress sites for unauthorized changes to podcast feeds, episodes, and plugin settings.
- Restrict access to wp-admin/admin-ajax.php and plugin REST routes from untrusted networks where feasible.
Patch Information
Refer to the Patchstack PowerPress Vulnerability Advisory for current fixed version information and vendor guidance. Apply the patched release through the WordPress plugin updater once published, and verify the installed version afterward.
Workarounds
- Temporarily disable the PowerPress plugin on sites that cannot be updated immediately.
- Add a WAF or reverse-proxy rule that blocks unauthenticated requests to PowerPress action and REST endpoints.
- Enforce IP allow-listing on wp-admin/ for administrative traffic to reduce exposure of plugin handlers.
# Example WAF rule concept (adapt to your WAF syntax)
# Block unauthenticated POSTs to admin-ajax.php referencing PowerPress actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1049387,msg:'Block unauth PowerPress action'"
SecRule ARGS:action "@rx ^powerpress_" \
"chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
