CVE-2026-16294CWE-918ssrf

CVE-2026-16294

High · published August 12, 2026

CVSS v3.1

7.1

EPSS

Percentile

20.4

In the wild

Unconfirmed

What it is

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.

The record

Technical detail

CVSS v3.1: 7.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00290 · 20.4th percentile
Weakness: CWE-918 · Server-Side Request Forgery (SSRF)
Published: 2026-08-12T10:18Z

References (1)

https://wpscan.com/vulnerability/9363aaff-40d6-41c0-8edd-cbf671240ad2/ · [email protected]

EPSS history

Timeline

12 AUG 06:00Z
Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL
cvelistv5