The PowerPress Podcasting plugin by Blubrry for WordPress versions prior to 11.17.1 contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). The plugin fails to validate one of its Podcast Episode URL settings before performing a server-side request, which allows users with Contributor role privileges to trigger SSRF attacks. This vulnerability could be used to target internal services that are otherwise inaccessible externally. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with Contributor-level access can exploit this vulnerability to perform SSRF attacks, potentially accessing or interacting with internal services that are not normally reachable. This could lead to unauthorized information disclosure or other impacts depending on the internal network configuration. The exact impact depends on the internal services accessible via SSRF and the privileges of the compromised WordPress user account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user permissions where possible and monitor for suspicious activity related to Podcast Episode URL settings. Avoid allowing untrusted users to modify these settings.