WordPress Plugin Vulnerabilities

Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery

Description

The plugin does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.

Proof of Concept

Affects Plugins

Plugin icon
podcast-player
Fixed in 8.3.1

References

CVE
CVE-2026-14860

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
ApogeeBytes
Submitter
ApogeeBytes
Verified
Yes
WPVDB ID
ea752266-9bff-4c36-91aa-9aca0232c7af

Timeline

Publicly Published
2026-08-06 (about 4 days ago)
Added
2026-08-06 (about 3 days ago)
Last Updated
2026-08-06 (about 3 days ago)

Other

Published
Title
Published
2025-03-04
Title
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF
Published
2023-09-15
Title
Dropbox Folder Share <= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link'
Published
2016-02-02
Title
WordPress 3.7-4.4.1 - Local URIs Server Side Request Forgery (SSRF)
Published
2025-05-13
Title
Ninja Forms Webhooks < 3.0.8 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook
Published
2024-04-22
Title
BuddyForms < 2.8.9 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery