Is CVE-2026-104407 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104407 being exploited in the wild.

How severe is CVE-2026-104407?

High severity, with a CVSS score of 7.1, published 5 October 2026.

Which products and versions are affected?

Blubrry Podcasting PowerPress through 11.17.9.

Is there a fix for CVE-2026-104407?

Yes: fixed in 11.17.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104407 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104407?

Check whether you run Blubrry Podcasting PowerPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104407: Blubrry PowerPress cross-site request forgery

CVE-2026-104407 · Severity: high · CVSS 7.1 · Published 2026-10-05

PowerPress is a WordPress plugin that manages podcast distribution and publishing. A cross-site request forgery (CSRF) vulnerability allows attackers to trick authenticated site administrators into performing unintended actions, such as modifying podcast settings or plugin configurations. An attacker can craft a malicious web page that, when visited by a logged-in administrator, executes unwanted changes without the administrator's knowledge or consent.

Vendors: Blubrry Podcasting.

Quick answers

Is CVE-2026-104407 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104407 being exploited in the wild.
How severe is CVE-2026-104407?: High severity, with a CVSS score of 7.1, published 5 October 2026.
Which products and versions are affected?: Blubrry Podcasting PowerPress through 11.17.9.
Is there a fix for CVE-2026-104407?: Yes: fixed in 11.17.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104407 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104407?: Check whether you run Blubrry Podcasting PowerPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 11.17.11

Technical details

The PowerPress plugin through version 11.17.9 lacks proper CSRF token validation on state-changing operations. An unauthenticated attacker can craft a forged request that, when triggered by a logged-in privileged user, executes administrative actions. The vulnerability requires user interaction (the administrator must visit a malicious page or click a crafted link while authenticated) but allows complete manipulation of podcast settings and plugin behavior.

Affected products

Blubrry Podcasting PowerPress through 11.17.9

Timeline

2026-09-18: disclosed: Reported by Intrudify
2026-10-05: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.