The Podlove Podcast Publisher plugin for WordPress contains a CSRF vulnerability (CWE-352) in the ajax_transcript_delete() function due to missing or incorrect nonce validation. This flaw allows an attacker to craft a forged request that, when executed by a site administrator (via user interaction like clicking a link), can delete arbitrary episode transcripts. The vulnerability affects all versions up to and including 4.2.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction, and impacting integrity with no confidentiality or availability impact.

An attacker can cause deletion of episode transcripts by exploiting the CSRF vulnerability if they successfully trick a site administrator into executing a malicious request. This results in limited integrity impact (loss of transcript data) but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation information is provided. Users should monitor the vendor's advisory channels for updates. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or nonce validations manually may mitigate the risk but should be done carefully.