CVE-2026-97354 in PowerPress Podcasting Plugin
Summary
by MITRE • 10/07/2026
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The PowerPress Podcasting plugin for WordPress, prior to version 11.17.11 developed by Blubrry, contains a critical server-side request forgery vulnerability stemming from insufficient validation of redirect destinations during the processing of user-supplied media URLs. This flaw allows authenticated attackers with contributor-level permissions or higher to manipulate the application into making HTTP requests to arbitrary internal resources that are not accessible via standard public internet routes. The core issue lies in how the plugin handles external media sources, specifically failing to enforce strict allowlists or validate final endpoints after following redirects, thereby bypassing initial input sanitization measures designed to restrict access to trusted domains only.
From a technical perspective, this vulnerability exploits the behavior of HTTP clients that automatically follow redirect responses such as 301 Moved Permanently or 302 Found without verifying if the new location falls within an approved set of hosts. An attacker can craft a malicious media URL pointing to a controlled external server configured to return a redirect header targeting an internal IP address, such as those associated with database servers, administrative interfaces, or other backend services running on private networks like 192.168.x.x or 10.x.x.x ranges. Because the plugin operates under the context of the authenticated user and executes server-side requests, it effectively acts as a proxy for these internal connections, enabling data exfiltration from internal systems that would otherwise be isolated from direct external access.
The operational impact of this vulnerability is significant within environments where WordPress instances are deployed behind firewalls or in private network segments intended to protect sensitive backend infrastructure. By leveraging server-side request forgery, an attacker with contributor privileges can probe the internal network topology, identify running services on non-standard ports, and potentially extract confidential data from unprotected endpoints such as Redis caches, MySQL databases, or internal API gateways. This capability undermines the principle of least privilege by allowing lower-level users to perform actions typically reserved for administrators, effectively escalating their impact beyond content management into infrastructure reconnaissance and potential lateral movement within the network architecture.
This vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes flaws where a web application fetches a remote resource without validating the user-supplied URL to ensure it does not point to an unexpected destination. In terms of offensive security frameworks, this technique corresponds to ATT&CK Tactic TA0008 Lateral Movement and specifically Technique T1570 Lateral Tool Transfer or T1046 Network Service Discovery when used for reconnaissance purposes. The lack of strict URL validation represents a common misconfiguration in web applications that interact with external resources, highlighting the necessity for rigorous input sanitization and output encoding practices to prevent abuse of internal network trust boundaries.
To mitigate this vulnerability, organizations should immediately upgrade the PowerPress Podcasting plugin to version 11.17.11 or later where these redirect validation issues have been addressed by implementing strict allowlists for permitted domains and validating final destination URLs after all redirects are resolved. Administrators lacking immediate patch availability should restrict contributor-level user privileges as much as possible, ensuring that only trusted individuals can submit media URLs through the plugin interface. Additionally, deploying a web application firewall with SSRF detection capabilities or configuring network segmentation to limit outbound traffic from WordPress servers to known external domains can provide an additional layer of defense against exploitation attempts targeting internal services.