CVE-2026-24360 is an SSRF vulnerability in the Seriously Simple Podcasting plugin for WordPress, maintained by Craig Hewitt. It affects all versions up to 3.14.1. The vulnerability allows an attacker with high privileges to cause the server to make unauthorized requests, which may lead to partial disclosure or modification of information. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact. No patch or vendor advisory details are currently available, and the product is not a cloud service.

An attacker with high privileges could exploit this SSRF vulnerability to make the server perform unintended requests, potentially accessing internal resources or causing limited information disclosure or modification. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to the Seriously Simple Podcasting plugin and monitor for suspicious activity related to server requests initiated by the plugin.