CVE-2026-104407: Cross-Site Request Forgery (CSRF) in Blubrry Podcasting PowerPress Podcasting

The vulnerability CVE-2026-104407 is a Cross-Site Request Forgery (CSRF) flaw in Blubrry Podcasting PowerPress Podcasting. It affects all versions from initial releases up to but not including version 11.17.11. The flaw allows attackers to induce authenticated users to execute unwanted actions without their consent, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to perform unauthorized actions on behalf of an authenticated user, impacting the confidentiality, integrity, and availability of the affected system to a limited degree. The vulnerability does not require privileges but does require user interaction. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and apply any official patches once available. Until then, consider implementing CSRF protections such as verifying anti-CSRF tokens in requests if possible.