CVE-2026-97354: CWE-918 Server-Side Request Forgery (SSRF) in PowerPress Podcasting plugin by Blubrry

The PowerPress Podcasting plugin by Blubrry before version 11.17.11 contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). This occurs because the plugin fails to validate the destination of redirects when fetching media URLs supplied by users. As a result, users with the contributor role or above can cause the server to make arbitrary HTTP requests to internal or external systems, potentially exposing internal services or sensitive information.

An attacker with contributor or higher privileges can exploit this vulnerability to make the server perform HTTP requests to internal services or other unintended destinations. This could lead to information disclosure or interaction with internal systems that are otherwise inaccessible externally. There is no indication of active exploitation in the wild at this time.

Upgrade the PowerPress Podcasting plugin to version 11.17.11 or later where this vulnerability is fixed. Since the affected versions are explicitly stated, applying the official update is the recommended remediation. Patch status is not explicitly confirmed in the input data, but the presence of a fixed version (11.17.11) implies an official fix is available.