This vulnerability (CVE-2026-24637) in PowerPress Podcasting (<=11.15.10) is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It enables an attacker with low privileges and no user interaction to execute crafted SQL commands that can compromise confidentiality and availability. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and high confidentiality impact with limited integrity impact and low availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could lead to unauthorized disclosure of sensitive data stored in the database and partial denial of service due to the injection of malicious SQL commands. Integrity impact is not indicated, but confidentiality is rated high and availability is rated low. The vulnerability requires low privileges but no user interaction, making it a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting contributor privileges and monitoring for suspicious database activity related to the PowerPress Podcasting plugin. Avoid exposing the affected plugin to untrusted users where possible.