CVE-2026-97354 Overview
CVE-2026-97354 is a Server-Side Request Forgery (SSRF) vulnerability in the PowerPress Podcasting plugin by Blubrry for WordPress. The flaw affects all versions prior to 11.17.11. The plugin fails to validate the destination of redirects when fetching a user-supplied media URL. Authenticated users with contributor-level privileges or above can exploit this weakness to send crafted requests to internal services behind the WordPress host. The vulnerability is classified as [CWE-918] Server-Side Request Forgery.
Critical Impact
Contributor-level accounts can pivot through the WordPress server to probe internal network services, metadata endpoints, and non-public resources normally unreachable from the internet.
Affected Products
- PowerPress Podcasting plugin by Blubrry for WordPress
- All versions prior to 11.17.11
- WordPress installations exposing contributor-or-above accounts
Discovery Timeline
- 2026-10-07 - CVE-2026-97354 published to NVD
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-97354
Vulnerability Analysis
The PowerPress plugin accepts a user-supplied media URL and performs a server-side fetch to retrieve metadata about the referenced resource. When the remote server responds with an HTTP redirect, the plugin follows the redirect without validating the new destination. Attackers can register an external URL that returns a redirect to an internal address such as 127.0.0.1, 169.254.169.254, or an RFC1918 range. The outbound request then originates from the WordPress host, bypassing network segmentation that normally shields internal services from external callers.
Exploitation requires an authenticated session with the contributor role or higher. This limits mass exploitation but remains relevant on multi-author sites, membership platforms, and any WordPress deployment that permits user registration with elevated roles. The scope is marked changed because the request crosses from the WordPress application context into adjacent internal systems.
Root Cause
The root cause is missing destination validation in the plugin's media fetch routine. The HTTP client follows redirects by default, and the plugin does not re-validate the Location header against an allowlist or block private IP ranges. See the WPScan Vulnerability Report for technical details.
Attack Vector
An attacker authenticates as a contributor and submits a media URL pointing to an attacker-controlled host. That host returns an HTTP 302 response with a Location header targeting an internal resource. The PowerPress fetch logic follows the redirect and returns the response content or timing information to the attacker, enabling reconnaissance of internal services, cloud metadata APIs, and unauthenticated admin interfaces.
Detection Methods for CVE-2026-97354
Indicators of Compromise
- Outbound HTTP requests from the WordPress host to RFC1918 addresses, 127.0.0.0/8, or cloud metadata endpoints such as 169.254.169.254.
- PowerPress media fetch requests originating from contributor accounts targeting unusual external hostnames.
- Web server access logs showing media URL submissions followed by internal connection attempts.
Detection Strategies
- Inspect PHP outbound traffic for connections to loopback and link-local ranges initiated by wp-cron or plugin fetch handlers.
- Correlate contributor account activity with new outbound destinations not previously observed from the host.
- Alert on HTTP 3xx redirect chains terminating at private IP space when sourced from the WordPress worker process.
Monitoring Recommendations
- Enable egress logging on the WordPress host and forward connection metadata to a central analytics platform.
- Track plugin-initiated HTTP requests through PHP error logs with WP_HTTP_BLOCK_EXTERNAL constants where feasible.
- Review contributor and author audit trails for unexpected media submissions.
How to Mitigate CVE-2026-97354
Immediate Actions Required
- Upgrade the PowerPress Podcasting plugin to version 11.17.11 or later on all WordPress sites.
- Audit contributor, author, editor, and administrator accounts and remove unused or stale users.
- Restrict outbound traffic from WordPress hosts to only required destinations using host or network firewalls.
Patch Information
Blubrry addressed the issue in PowerPress Podcasting plugin version 11.17.11. The fix validates redirect destinations during the media URL fetch. Apply the update through the WordPress plugin dashboard or by replacing the plugin files via WP-CLI. Reference: WPScan Vulnerability Report.
Workarounds
- Deny contributor-and-above roles access to media URL submission features until patching is complete.
- Block outbound requests from the WordPress host to private IP ranges and cloud metadata endpoints at the network layer.
- Use a web application firewall rule to drop media fetch requests that resolve to internal addresses.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
