CVE-2026-13729
Received Received - Intake

CSRF in Podlove Podcast Publisher WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-13729
EUVD
EUVD-2026-51703

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
podlove podlove_podcast_publisher to 4.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Podlove Podcast Publisher WordPress plugin before version 4.5.3. It allows attackers to create unauthorized records or delete existing ones by tricking a logged-in administrator into visiting a malicious page. The plugin fails to validate nonces for certain administrative actions.

Detection Guidance

To detect this vulnerability, check if the Podlove Podcast Publisher WordPress plugin version is below 4.5.3. Log in to your WordPress admin panel, go to Plugins, and verify the installed version. If it is outdated, the vulnerability likely exists.

Impact Analysis

If you use the Podlove Podcast Publisher plugin before version 4.5.3, an attacker could exploit this to add fake content or delete legitimate podcast episodes, show notes, or other data. This could disrupt your podcast operations and damage your site's integrity.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized creation or deletion of records through CSRF attacks. If exploited, it may lead to unauthorized modifications of sensitive data, which could violate data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Immediately update the Podlove Podcast Publisher plugin to version 4.5.3 or later. After updating, review plugin settings and records for any unauthorized changes or deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13729. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart