CVE-2026-13729 Overview
CVE-2026-13729 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Podlove Podcast Publisher WordPress plugin in versions prior to 4.5.3. The plugin fails to perform nonce validation on several administrative create and delete actions. An attacker who tricks a logged-in administrator into visiting a crafted page can force the browser to submit forged requests. These requests can create rogue records or delete legitimate ones inside the plugin without the administrator's consent.
Critical Impact
Successful exploitation permits unauthorized creation and deletion of plugin records through a forged administrative request, impacting the integrity of podcast publishing data.
Affected Products
- Podlove Podcast Publisher WordPress plugin versions before 4.5.3
- WordPress sites with the plugin installed and active
- Administrator sessions on affected WordPress installations
Discovery Timeline
- 2026-08-01 - CVE-2026-13729 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-13729
Vulnerability Analysis
The Podlove Podcast Publisher plugin exposes administrative endpoints that create and delete records inside the WordPress admin area. WordPress provides a built-in nonce mechanism to bind sensitive state-changing requests to an authenticated session. The affected versions of the plugin omit calls to check_admin_referer() or wp_verify_nonce() on several of these endpoints. As a result, the plugin processes any well-formed request submitted by an authenticated administrator's browser, regardless of origin.
An attacker exploits this by hosting a page that issues a crafted GET or POST request to the vulnerable endpoint. When an authenticated administrator visits the page, the browser sends the request with valid session cookies. The plugin executes the create or delete action as if the administrator initiated it. Exploitation requires user interaction, which is reflected in the attack complexity of the vulnerability.
Root Cause
The root cause is missing anti-CSRF token verification on specific administrative handlers within the plugin. WordPress nonces exist precisely to prevent this class of attack, and their absence removes the request-origin check that would otherwise block forged submissions.
Attack Vector
The attack vector is network-based and requires social engineering. The attacker delivers a malicious link through phishing, forum posts, or a compromised site. The forged request executes with administrator privileges once the target visits the page. The vulnerability is described in detail in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-13729
Indicators of Compromise
- Unexpected creation or deletion of Podlove records (episodes, feeds, contributors) not tied to legitimate administrator activity
- HTTP referer headers on plugin admin actions pointing to external or untrusted domains
- Administrative POST or GET requests to Podlove endpoints without accompanying _wpnonce parameter values
Detection Strategies
- Review WordPress audit logs for Podlove create and delete actions that do not correlate with administrator working hours or documented changes
- Inspect web server access logs for cross-origin requests targeting wp-admin endpoints associated with the Podlove plugin
- Correlate browser-based phishing indicators against administrator user agents accessing the WordPress admin console
Monitoring Recommendations
- Enable a WordPress activity logging plugin that records create and delete events with source IP and referer
- Alert on administrative actions performed within seconds of a click on an external link in email or messaging telemetry
- Monitor for unexpected changes to podcast feeds, episodes, or contributor entries and flag deletions for administrator review
How to Mitigate CVE-2026-13729
Immediate Actions Required
- Update the Podlove Podcast Publisher plugin to version 4.5.3 or later on all affected WordPress installations
- Audit existing Podlove records for unauthorized creations or deletions performed before the patch was applied
- Require administrators to log out of the WordPress admin panel when not actively working on the site
Patch Information
The vendor released a fixed version of the plugin that adds nonce validation to the previously unprotected create and delete actions. Site owners should upgrade to Podlove Podcast Publisher 4.5.3 or later. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict administrator accounts to dedicated browser profiles that are not used for general web browsing or email
- Deploy a web application firewall rule that blocks cross-origin POST requests to wp-admin endpoints lacking a valid _wpnonce parameter
- Limit the number of accounts holding the WordPress administrator role until patching is complete
# Example WP-CLI command to update the plugin to the patched version
wp plugin update podlove-podcasting-plugin-for-wordpress --version=4.5.3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
