Is CVE-2026-13729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13729 being exploited in the wild.

How severe is CVE-2026-13729?

Informational severity, with a CVSS score of 4.3, published 1 August 2026.

Which products and versions are affected?

Podlove Podcast Publisher < 4.5.3.

Is there a fix for CVE-2026-13729?

A patch was published on 2026-08-01: Fixed in version 4.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13729 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13729?

Check whether you run Podlove Podcast Publisher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13729: Podlove Podcast Publisher CSRF in contributor and role management

Q: Is there a fix for CVE-2026-13729?

A patch was published on 2026-08-01: Fixed in version 4.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-13729 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-13729?

Check whether you run Podlove Podcast Publisher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13729 · Severity: info · CVSS 4.3 · Published 2026-08-01

The Podlove Podcast Publisher plugin for WordPress, which helps users manage and publish podcast episodes, contains a security flaw that could allow an attacker to modify podcast data. By tricking a logged-in administrator into clicking a malicious link, an attacker can remotely create or delete podcast contributors, groups, and roles. This could lead to unauthorized changes in how a podcast is managed or the loss of legitimate administrative records.

Technologies: Podlove Podcast Publisher. Vendors: Podlove.

Quick answers

Is CVE-2026-13729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13729 being exploited in the wild.
How severe is CVE-2026-13729?: Informational severity, with a CVSS score of 4.3, published 1 August 2026.
Which products and versions are affected?: Podlove Podcast Publisher < 4.5.3.
Is there a fix for CVE-2026-13729?: A patch was published on 2026-08-01: Fixed in version 4.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13729 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13729?: Check whether you run Podlove Podcast Publisher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Podlove Podcast Publisher plugin for WordPress fails to implement nonce validation on several administrative actions related to contributor, group, and role management. This lack of CSRF protection allows a remote attacker to perform unauthorized create and delete operations by inducing an authenticated administrator to visit a specially crafted webpage. The vulnerability is rooted in the plugin's administrative backend and can result in the modification or deletion of database records. The issue is resolved in version 4.5.3.

Affected products

Podlove Podlove Podcast Publisher < 4.5.3

Timeline

2026-07-20: disclosed
2026-08-01: advisory: NVD publication date
2026-08-01: patched: Fixed in version 4.5.3

References

https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.