The Podcast Player WordPress plugin versions prior to 8.3.1 contain a CWE-918 SSRF vulnerability due to lack of validation on user-supplied input used to build server-side requests. This flaw enables unauthenticated attackers to coerce the server into issuing requests to arbitrary external or internal hosts and retrieve responses that the plugin processes as RSS/XML data. The vulnerability was published on August 10, 2026, but no CVSS score or vendor advisory with remediation details is currently available.

An attacker can exploit this vulnerability to make the server perform unauthorized requests to arbitrary hosts, potentially accessing internal network resources or external services. The attacker can read the responses returned by these requests if they parse as RSS/XML, which may lead to information disclosure. There is no indication of active exploitation in the wild or further impact details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Podcast Player plugin to prevent exploitation.