CVE-2026-14860: Podcast Player WordPress Plugin SSRF Flaw

CVE-2026-14860 Overview

CVE-2026-14860 is a Server-Side Request Forgery (SSRF) vulnerability in the Podcast Player WordPress plugin versions before 8.3.1. The plugin builds a server-side request from user-supplied input without validating the destination host. Unauthenticated attackers can force the WordPress server to issue HTTP requests to arbitrary hosts and read back responses that parse as RSS or XML content. This allows adversaries to probe internal networks, access metadata endpoints, or reach services otherwise unreachable from the public internet.

Critical Impact
Unauthenticated remote attackers can pivot through vulnerable WordPress installations to reach internal-only services and exfiltrate response data that parses as RSS/XML [CWE-918].

Affected Products

Podcast Player WordPress plugin versions prior to 8.3.1
WordPress sites with the Podcast Player plugin installed and active
Any hosting environment exposing the plugin's request-issuing endpoint to unauthenticated users

Discovery Timeline

2026-08-10 - CVE-2026-14860 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-14860

Vulnerability Analysis

The Podcast Player plugin accepts a user-supplied URL and issues a server-side HTTP request to fetch podcast feed content. The plugin passes the input directly to its request layer without applying an allowlist, host validation, or scheme restrictions. The server then parses the response as RSS/XML and returns any successfully parsed content to the caller.

An attacker supplies a URL pointing to an internal service, a cloud metadata endpoint, or a private-network IP address. The WordPress server issues the outbound request from its own network position. Any response that the parser can interpret as RSS or XML flows back to the attacker. The Common Weakness Enumeration classifies this pattern as [CWE-918] Server-Side Request Forgery.

Root Cause

The root cause is missing destination validation on a server-side request constructed from untrusted input. The plugin does not enforce a host allowlist, does not block private IP address ranges (RFC 1918, loopback, link-local), and does not restrict URL schemes to http and https against public endpoints.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the plugin's feed-fetching endpoint with a target URL such as http://169.254.169.254/latest/meta-data/ or an internal service address. The server retrieves the response, parses it as RSS/XML, and returns parseable portions to the attacker. Refer to the WPScan Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-14860

Indicators of Compromise

Outbound HTTP requests originating from the WordPress PHP process to internal IP ranges, 127.0.0.1, or 169.254.169.254
Web server access logs showing repeated requests to the Podcast Player plugin's feed endpoint with varying url or feed parameter values
Unusual DNS lookups for internal hostnames initiated by the web server
Requests to the plugin endpoint from unauthenticated sessions immediately followed by outbound connections to non-podcast hosts

Detection Strategies

Monitor egress traffic from web application servers for connections to RFC 1918 addresses, loopback, and cloud metadata service IPs
Alert on WordPress PHP-FPM or Apache worker processes initiating outbound TCP connections to non-standard external destinations
Parse web server logs for requests to Podcast Player plugin routes with attacker-controlled URL parameters
Correlate authentication state with plugin endpoint access to surface unauthenticated feed-fetch activity

Monitoring Recommendations

Enable outbound network flow logging on hosts running WordPress and forward events to a centralized analytics platform
Baseline normal outbound destinations from web servers and alert on deviations
Track HTTP response sizes returned by the plugin endpoint to identify data exfiltration patterns
Review cloud provider metadata service access logs where applicable (AWS IMDSv1, GCP metadata server)

How to Mitigate CVE-2026-14860

Immediate Actions Required

Update the Podcast Player WordPress plugin to version 8.3.1 or later immediately
Audit WordPress installations across the environment to identify vulnerable instances
Block outbound requests from web servers to internal IP ranges and cloud metadata endpoints at the network layer
Review web server and application logs for prior exploitation attempts against the plugin endpoint

Patch Information

The vendor addressed this vulnerability in Podcast Player version 8.3.1. Site administrators should upgrade through the WordPress plugin manager or by replacing the plugin files with the fixed release. See the WPScan Vulnerability Advisory for reference.

Workarounds

Deactivate and remove the Podcast Player plugin until the patched version can be deployed
Enforce egress filtering at the firewall or cloud security group level to block WordPress hosts from reaching 169.254.169.254, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16
Require IMDSv2 with session tokens on AWS EC2 instances hosting WordPress to prevent metadata theft via SSRF
Place a web application firewall rule in front of the plugin endpoint to reject requests where the URL parameter resolves to internal address space

bash

# Example egress restriction using iptables on a WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 ! -o lo -j REJECT