The PowerPress Podcasting plugin for WordPress is vulnerable to a Server-Side Request Forgery flaw that allows low-privileged users to probe internal network services.

This is a Server-Side Request Forgery (CWE-918) vulnerability occurring because the plugin does not validate user-supplied Podcast Episode URLs. An attacker with Contributor-level privileges can leverage this flaw to force the server to initiate unauthorized requests to internal network resources.

Successful exploitation of this vulnerability allows an attacker to bypass perimeter security and interact with internal services that are not exposed to the public internet. Given the CVSS score of 7.1, this represents a high-severity risk that could lead to unauthorized information disclosure or the exploitation of other internal vulnerabilities, potentially resulting in full compromise of the affected web server.

Immediate Action: Update the PowerPress Podcasting plugin to version 11.17.1 or later immediately to apply the necessary input validation fixes.

Proactive Monitoring: Monitor server access logs and outbound network traffic originating from the web server for unusual requests to internal IP addresses or local loopback interfaces.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests containing suspicious URL patterns, and ensure the web server is segmented from sensitive internal network zones.

Public Exploit Available: Unknown

Organizations utilizing the PowerPress Podcasting plugin must prioritize updating to version 11.17.1 to neutralize this SSRF vector. Because the vulnerability requires only Contributor-level access, the risk of internal reconnaissance by malicious or compromised accounts is significant, necessitating prompt remediation to protect the internal network perimeter.