CVE-2026-13729 is a CSRF vulnerability in Podlove Podcast Publisher WordPress plugin before version 4.5.3. The plugin does not validate nonces on some administrative create and delete operations, enabling attackers to forge requests that a logged-in administrator might unknowingly execute. This can lead to unauthorized creation or deletion of records within the plugin's administrative interface.

The vulnerability allows an attacker to cause a logged-in administrator to perform unintended create or delete actions within the plugin. This can result in the creation of rogue records or deletion of legitimate records. There is no direct confidentiality or availability impact reported. The CVSS score of 4.3 reflects a medium severity with low complexity and requiring user interaction.

A fixed version 4.5.3 or later of the Podlove Podcast Publisher plugin should be applied to address this vulnerability. Since the vulnerability is due to missing nonce validation, upgrading to the patched version that includes proper nonce checks is the recommended remediation. Patch status is not explicitly confirmed in the provided data, so users should verify the availability of the fix from the vendor or official plugin repository.