# CVE-2026-121766: Blubrry PowerPress Podcasting broken access control

Source: https://junglewise.ai/threats/cve-2026-121766-missing-authorization-vulnerability-in-blubrry-podcasting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-121766 · Severity: medium · CVSS 5.4 · Published 2026-11-07

Blubrry PowerPress is a WordPress plugin for managing podcasts and distributing them to podcasting platforms. The plugin contains a broken access control vulnerability that allows users with contributor-level privileges to access pages or perform actions they should not be authorized to perform, potentially exposing other users' data.

Technologies: [Blubrry PowerPress Podcasting](https://junglewise.ai/threats/technologies/blubrry-powerpress-podcasting). Vendors: [Blubrry](https://junglewise.ai/threats/vendors/blubrry).

## Quick answers

**Is CVE-2026-121766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121766 being exploited in the wild.

**How severe is CVE-2026-121766?** Medium severity, with a CVSS score of 5.4, published 7 November 2026.

**Which products and versions are affected?** Blubrry PowerPress Podcasting up to 11.18.0.

**Is there a fix for CVE-2026-121766?** Yes: fixed in 11.18.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121766 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-121766?** Check whether you run Blubrry PowerPress Podcasting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.18.2

## Technical details

A broken access control vulnerability in PowerPress Podcasting versions up to 11.18.0 permits users with contributor-level privileges to bypass authorization checks and access restricted functionality or data. This is a post-authentication vulnerability requiring a logged-in contributor account, affecting the access control enforcement within the plugin. The fix is available in version 11.18.2.

## Affected products

- Blubrry PowerPress Podcasting up to 11.18.0

## Timeline

- 2026-10-25: disclosed
- 2026-11-07: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-18-0-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-18-0-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Blubrry PowerPress Podcasting broken access control](https://junglewise.ai/threats/cve-2026-125782-missing-authorization-vulnerability-in-blubrry-podcasting)
- [Blubrry PowerPress Podcasting cross-site request forgery](https://junglewise.ai/threats/cve-2026-121762-cross-site-request-forgery-csrf-vulnerability-in-blubrry)
- [PowerPress Podcasting plugin SSRF via redirect validation](https://junglewise.ai/threats/cve-2026-97354-the-powerpress-podcasting-plugin-by-blubrry-wordpress-plugin)
- [PowerPress Podcasting broken access control](https://junglewise.ai/threats/cve-2026-104387-unauthenticated-broken-access-control-in-powerpress-podcasting)
- [PowerPress Podcasting plugin stored cross-site scripting in block attribute](https://junglewise.ai/threats/cve-2026-97319-the-powerpress-podcasting-plugin-by-blubrry-wordpress-plugin)