Threat database

Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9.

CVE-2026-104407 is a Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting affecting versions from initial release up to 11.17.10. This vulnerability allows an attacker to trick a user into performing unwanted actions on the affected application. The CVSS score is 7.1, indicating a high severity impact with potential confidentiality, integrity, and availability consequences.

A SQL Injection vulnerability (CWE-89) exists in Blubrry Podcasting PowerPress Podcasting versions up to and including 11.15.10. This vulnerability allows an attacker with limited privileges to inject SQL commands via contributor input, potentially leading to high confidentiality impact and limited availability impact. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.