CVE-2026-13729 is a CSRF vulnerability in the Podlove Podcast Publisher WordPress plugin affecting versions prior to 4.5.3. The vulnerability arises because the plugin does not validate nonces on some administrative create and delete operations. An attacker can exploit this by convincing an authenticated administrator to visit a maliciously crafted webpage, causing unauthorized creation or deletion of records within the plugin's administrative interface.

Successful exploitation allows attackers to perform unauthorized administrative actions such as creating rogue records or deleting legitimate ones within the Podlove Podcast Publisher plugin. This can lead to data integrity issues and potential disruption of podcast publishing management. The vulnerability requires the victim to be an authenticated administrator and to visit a malicious page, so the attack vector is limited to social engineering combined with the CSRF flaw.

No official patch or remediation level is currently confirmed. Users should upgrade to Podlove Podcast Publisher version 4.5.3 or later once available, as the vulnerability affects versions before 4.5.3. Until a patch is confirmed, administrators should avoid visiting untrusted or suspicious websites while logged into WordPress with administrative privileges. Monitor the vendor advisory for updates on official fixes.