WordPress Plugin Vulnerabilities

PowerPress Podcasting < 11.13.12 - Contributor+ Server-Side Request Forgery

Description

The plugin is vulnerable to Server-Side Request Forgery. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
powerpress
Fixed in 11.13.12

References

CVE
CVE-2025-49984
URL
https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-12-11-server-side-request-forgery-ssrf-vulnerability

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Nguyễn Trung Kiên
Verified
No
WPVDB ID
cc39d941-985a-429b-9a3c-2134dbc046f1

Timeline

Publicly Published
2025-06-19 (about 1 year ago)
Added
2025-06-25 (about 1 year ago)
Last Updated
2025-09-20 (about 9 months ago)

Other

Published
Title
Published
2022-04-19
Title
External Media without Import <= 1.1.2 - Subscriber+ Blind SSRF
Published
2023-03-02
Title
Instant Images < 5.2.0 - Author+ SSRF
Published
2025-11-23
Title
External Media <= 1.0.36 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2026-02-14
Title
Simple Blog Card < 2.38 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2023-12-27
Title
Happy Addons for Elementor < 3.10.0 - Contributor+ SSRF