medium4.3
CVE-2026-13729
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing…
Impact
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
Affected products
| Product | Affected versions |
|---|---|
| Podlove Podcast Publisher WordPress Plugin | before 4.5.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.