CVE-2026-24637: PowerPress Podcasting SQLi Vulnerability

CVE-2026-24637 Overview

CVE-2026-24637 is a SQL injection vulnerability in the Blubrry PowerPress Podcasting plugin for WordPress, affecting versions up to and including 11.15.10. The flaw allows authenticated users with Contributor-level privileges to inject malicious SQL statements into database queries. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

An attacker exploiting this issue can read sensitive data from the WordPress database, including user credentials, session tokens, and private content. The vulnerability has a changed scope, indicating impact extends beyond the vulnerable component.

Critical Impact
Authenticated contributors can extract sensitive database contents and degrade site availability through crafted SQL payloads sent to PowerPress plugin endpoints.

Affected Products

Blubrry PowerPress Podcasting plugin for WordPress versions <= 11.15.10
WordPress sites granting Contributor or higher roles to untrusted users
Multi-author podcast sites using PowerPress for episode management

Discovery Timeline

2026-06-15 - CVE-2026-24637 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-24637

Vulnerability Analysis

The vulnerability resides in the PowerPress Podcasting plugin, which extends WordPress with podcast feed generation, episode management, and media handling features. User-supplied input passes into SQL queries without proper sanitization or parameterization. A Contributor-role account can manipulate query logic by injecting SQL syntax through plugin parameters.

Exploitation requires authentication at the Contributor level, which is a low privilege barrier on multi-author WordPress sites. The attacker sends crafted requests over the network with no user interaction required. Successful exploitation grants the attacker read access to arbitrary database tables, including the wp_users table holding password hashes.

The scope change in the impact rating reflects that compromised database contents can be used to pivot beyond the plugin itself. Attackers can extract administrator credentials, forge sessions, or stage further attacks against the WordPress core.

Root Cause

The root cause is missing or insufficient input neutralization in plugin code that constructs SQL queries from request parameters. Instead of using prepared statements through the WordPress $wpdb->prepare() API with proper placeholders, the affected code path concatenates user input directly into query strings. See the Patchstack PowerPress SQL Injection Advisory for technical details.

Attack Vector

The attack vector is network-based through standard HTTP(S) requests to a WordPress site with PowerPress installed. The attacker authenticates as a Contributor, then submits requests containing SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based payloads to plugin endpoints. The injected SQL executes within the database context of the WordPress installation, returning data through response content or inferred via timing and boolean differentials.

Detection Methods for CVE-2026-24637

Indicators of Compromise

HTTP requests to PowerPress plugin endpoints containing SQL syntax such as UNION SELECT, SLEEP(, INFORMATION_SCHEMA, or encoded variants
Unexpected database errors in WordPress debug logs originating from PowerPress code paths
Contributor accounts issuing high volumes of POST or GET requests to plugin handlers in short windows
New or modified administrator accounts following Contributor activity

Detection Strategies

Inspect web server access logs for plugin URLs with suspicious query parameters or POST bodies containing SQL keywords
Enable WordPress query logging and review queries originating from PowerPress for tautologies or stacked statements
Deploy a Web Application Firewall (WAF) with WordPress-specific signatures to flag SQL injection patterns

Monitoring Recommendations

Alert on authentication events for Contributor accounts followed by access to plugin AJAX or REST endpoints
Monitor for outbound database queries against wp_users, wp_usermeta, and wp_options tables outside expected application flow
Track plugin file integrity and version state through scheduled scans

How to Mitigate CVE-2026-24637

Immediate Actions Required

Update the PowerPress Podcasting plugin to a version above 11.15.10 once the vendor publishes a fixed release
Audit all Contributor and higher role accounts and remove dormant or untrusted users
Rotate WordPress administrator passwords and invalidate active sessions if Contributor accounts show suspicious activity
Review database audit logs for unauthorized SELECT activity against sensitive tables

Patch Information

Refer to the Patchstack PowerPress SQL Injection Advisory for the latest patched version information. Apply the fixed plugin release through the WordPress admin dashboard or via WP-CLI as soon as it is available.

Workarounds

Restrict Contributor role assignment to trusted users only until the patch is applied
Deploy a virtual patch through Patchstack or an equivalent WAF rule blocking SQL injection payloads to PowerPress endpoints
Temporarily deactivate the PowerPress plugin on sites that cannot enforce role restrictions or WAF coverage

bash

# Disable PowerPress plugin via WP-CLI until patched
wp plugin deactivate powerpress

# List all Contributor-level users for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered