CVE-2024-1109 is a missing authorization vulnerability in the Podlove Podcast Publisher plugin for WordPress, affecting all versions up to and including 4.0.11. The issue arises because the init_download() and init() functions do not perform capability checks, allowing unauthenticated users to access and export sensitive plugin tracking data and podcast information. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits are reported in the wild, and no patch or vendor advisory has been provided.

An unauthenticated attacker can access and export sensitive tracking data and podcast information from the Podlove Podcast Publisher plugin. This results in confidentiality loss of data managed by the plugin. There is no impact on integrity or availability reported. The vulnerability does not require user interaction or privileges, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the plugin's endpoints or disabling the plugin if possible to prevent unauthorized data export. Monitor official channels for updates or patches from the vendor.