CVE-2026-16294: PowerPress Podcasting Plugin SSRF Vulnerability

CVE-2026-16294 Overview

CVE-2026-16294 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the PowerPress Podcasting plugin by Blubrry for WordPress. The plugin fails to validate one of its Podcast Episode URL settings before issuing a server-side HTTP request. Authenticated users with a role as low as Contributor can supply arbitrary URLs, causing the WordPress server to send requests to attacker-chosen destinations. This behavior enables attackers to probe internal services, cloud metadata endpoints, and other resources reachable from the hosting environment. All versions of the plugin prior to 11.17.1 are affected.

Critical Impact
Contributor-level users can force the WordPress server to make outbound requests to internal services, exposing metadata endpoints, internal APIs, and non-public infrastructure.

Affected Products

PowerPress Podcasting plugin by Blubrry for WordPress, versions prior to 11.17.1
WordPress sites that permit Contributor or higher role registration with the plugin enabled
Hosting environments where the WordPress instance can reach internal network services

Discovery Timeline

2026-08-12 - CVE-2026-16294 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-16294

Vulnerability Analysis

The vulnerability resides in the handling of a Podcast Episode URL setting exposed by the PowerPress plugin. The plugin accepts a user-supplied URL and passes it to a server-side HTTP request routine without validating the destination. Because the request originates from the WordPress host, it inherits network reachability to internal-only resources such as 127.0.0.1, RFC1918 addresses, and cloud metadata services like http://169.254.169.254/. Attackers can enumerate internal services, retrieve responses reflected through the plugin, or trigger unintended actions on internal HTTP endpoints. The confidentiality impact is high because responses from internal services may include sensitive data, credentials, or cloud instance metadata.

Root Cause

The root cause is missing input validation on a URL parameter used as the target of an outbound HTTP request [CWE-918]. The plugin does not enforce an allowlist of schemes or hosts, nor does it block requests to loopback, link-local, or private IP ranges. Combined with a low authorization threshold, the Contributor role, the missing validation lets minimally privileged accounts drive server-side requests.

Attack Vector

An attacker registers or compromises a Contributor account on a vulnerable WordPress site. The attacker navigates to the podcast episode configuration and supplies a crafted URL pointing to an internal service, cloud metadata endpoint, or an out-of-band listener. When the plugin processes the setting, the WordPress server issues the request to the attacker-controlled destination and may return or act on the response. No user interaction from an administrator is required. Refer to the WPScan Vulnerability Report for further technical detail.

Detection Methods for CVE-2026-16294

Indicators of Compromise

Outbound HTTP requests from the WordPress host to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) originating from PHP processes
Requests from the WordPress server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
Unexpected wp-admin activity from Contributor accounts modifying podcast episode URL settings
HTTP requests to attacker-controlled out-of-band domains that correlate with PowerPress plugin activity

Detection Strategies

Inspect WordPress wp_options and post metadata for PowerPress episode URL fields containing non-podcast destinations
Monitor web server and PHP request logs for outbound HTTP calls generated by PowerPress code paths
Correlate low-privilege user actions with subsequent outbound network requests from the WordPress host

Monitoring Recommendations

Enable egress logging on WordPress hosts and alert on connections to private, loopback, and link-local address ranges
Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS to require session tokens for metadata access
Audit Contributor and higher role accounts, including registration events and password resets

How to Mitigate CVE-2026-16294

Immediate Actions Required

Upgrade the PowerPress Podcasting plugin by Blubrry to version 11.17.1 or later on all WordPress installations
Review Contributor and higher accounts and remove or reset any unrecognized or dormant users
Restrict outbound network access from the WordPress host to only the destinations required for legitimate podcast operations

Patch Information

The vendor addressed the issue in PowerPress version 11.17.1 by validating the Podcast Episode URL setting before executing the server-side request. Administrators should update through the WordPress plugin manager or by deploying the fixed release. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the PowerPress plugin until the patched version can be installed
Restrict the Contributor role or disable open user registration on affected WordPress sites
Place the WordPress host behind an egress proxy that blocks requests to internal IP ranges and cloud metadata endpoints

bash

# Example egress restriction using iptables to block metadata and private ranges from the web server user
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT