CVE-2026-104407: PowerPress Podcasting CSRF Vulnerability

CVE-2026-104407 Overview

CVE-2026-104407 is a Cross-Site Request Forgery (CSRF) vulnerability in the Blubrry PowerPress Podcasting plugin for WordPress. The flaw affects all versions up to and including 11.17.9. An attacker can craft a malicious request that, when triggered by an authenticated user visiting an attacker-controlled page, performs unintended actions in the plugin on behalf of the victim. The weakness is tracked under CWE-352 and requires user interaction to succeed.

Critical Impact
Successful exploitation lets a remote attacker alter plugin state or settings through a victim's authenticated session, with scope change extending the impact beyond the vulnerable component.

Affected Products

Blubrry PowerPress Podcasting plugin for WordPress
All versions from unspecified initial release through 11.17.9
WordPress sites that have the plugin installed and activated

Discovery Timeline

2026-10-05 - CVE-2026-104407 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104407

Vulnerability Analysis

The PowerPress Podcasting plugin exposes one or more state-changing endpoints that do not adequately verify the origin or authenticity of incoming requests. Without a valid anti-CSRF token (typically a WordPress nonce) or equivalent origin checks, the plugin processes requests that appear to come from an authenticated user even when the request was initiated by a third-party site.

An attacker hosts a malicious page containing an auto-submitting form or image tag pointing to the vulnerable plugin endpoint. When a logged-in WordPress administrator or editor visits the page, the browser transmits the user's session cookies alongside the forged request. The plugin then processes the request with the victim's privileges.

The CVSS vector indicates a scope change, meaning the impact can reach components beyond the plugin itself, such as WordPress configuration or content accessible to the authenticated role.

Root Cause

The root cause is missing or insufficient CSRF protection on state-changing actions in the plugin. WordPress plugins typically mitigate this class of flaw with wp_nonce_field() on forms and check_admin_referer() or wp_verify_nonce() on handlers. The affected code paths in PowerPress through 11.17.9 do not consistently enforce these checks.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker must convince an authenticated user, typically through phishing or a malicious link, to load a page that issues the forged request. No prior authentication by the attacker is required. The attack leverages the victim's existing session, so success depends on the role and permissions assigned to that user.

For additional technical context, review the Patchstack Security Advisory.

Detection Methods for CVE-2026-104407

Indicators of Compromise

Unexpected changes to PowerPress plugin configuration, podcast feeds, or media URLs
HTTP POST requests to PowerPress admin endpoints with Referer headers pointing to external domains
Administrator sessions performing plugin actions shortly after visiting external links
New or modified podcast entries that no legitimate user acknowledges creating

Detection Strategies

Review WordPress audit logs for plugin setting changes correlated with external referrers
Monitor web server access logs for POST requests to /wp-admin/admin.php?page=powerpress* lacking valid nonce parameters
Alert on administrative actions originating from off-hours sessions or unusual geolocations

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture plugin configuration changes with user attribution
Forward web server and WordPress logs to a centralized SIEM for correlation across sessions
Baseline normal administrator behavior and alert on deviations in plugin administration activity

How to Mitigate CVE-2026-104407

Immediate Actions Required

Update the PowerPress Podcasting plugin to a version later than 11.17.9 as soon as the vendor publishes a fix
Audit WordPress administrator and editor accounts and remove unused privileged users
Instruct privileged users to log out of WordPress before browsing untrusted sites
Review recent plugin configuration changes for signs of unauthorized modification

Patch Information

At the time of publication, verify the latest release on the Patchstack Security Advisory and the plugin's WordPress.org page. Apply the fixed version through the WordPress plugin updater once available.

Workarounds

Deactivate the PowerPress Podcasting plugin until a patched version is installed
Deploy a web application firewall rule to block requests to PowerPress admin endpoints lacking a valid WordPress nonce
Restrict access to /wp-admin/ by source IP where feasible
Enforce SameSite=Lax or SameSite=Strict on WordPress session cookies to reduce cross-site request risk

bash

# Example WAF rule concept (ModSecurity) to require a nonce parameter
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
  "chain,phase:2,deny,status:403,id:1026104407,\
   msg:'PowerPress admin request missing nonce'"
  SecRule ARGS:page "@beginsWith powerpress" "chain"
  SecRule &ARGS:_wpnonce "@eq 0"