# CVE-2026-13729: Podlove Podcast Publisher CSRF in contributor and role management

Source: https://junglewise.ai/threats/cve-2026-13729-podlove-podcast-publisher-csrf-in-contributor-and-role-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2026-13729 · Severity: info · CVSS 4.3 · Published 2026-08-01

The Podlove Podcast Publisher plugin for WordPress, which helps users manage and publish podcast episodes, contains a security flaw that could allow an attacker to modify podcast data. By tricking a logged-in administrator into clicking a malicious link, an attacker can remotely create or delete podcast contributors, groups, and roles. This could lead to unauthorized changes in how a podcast is managed or the loss of legitimate administrative records.

Technologies: [Podlove Podcast Publisher](https://junglewise.ai/threats/technologies/podlove-podcast-publisher). Vendors: [Podlove](https://junglewise.ai/threats/vendors/podlove).

## Quick answers

**Is CVE-2026-13729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13729 being exploited in the wild.

**How severe is CVE-2026-13729?** Informational severity, with a CVSS score of 4.3, published 1 August 2026.

**Which products and versions are affected?** Podlove Podcast Publisher < 4.5.3.

**Is there a fix for CVE-2026-13729?** A patch was published on 2026-08-01: Fixed in version 4.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13729 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13729?** Check whether you run Podlove Podcast Publisher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Podlove Podcast Publisher plugin for WordPress fails to implement nonce validation on several administrative actions related to contributor, group, and role management. This lack of CSRF protection allows a remote attacker to perform unauthorized create and delete operations by inducing an authenticated administrator to visit a specially crafted webpage. The vulnerability is rooted in the plugin's administrative backend and can result in the modification or deletion of database records. The issue is resolved in version 4.5.3.

## Affected products

- Podlove Podlove Podcast Publisher < 4.5.3

## Timeline

- 2026-07-20: disclosed
- 2026-08-01: advisory: NVD publication date
- 2026-08-01: patched: Fixed in version 4.5.3

## References

- [https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/](https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/)

## Related threats

- [Podlove Podcast Publisher stored cross-site scripting in Auphonic webhook](https://junglewise.ai/threats/cve-2026-93775-the-podlove-podcast-publisher-plugin-for-wordpress-is-vulnerable)
- [Podlove Podcast Publisher arbitrary file upload in podlove_handle_cache_files](https://junglewise.ai/threats/cve-2026-13001-podlove-podcast-publisher-arbitrary-file-upload-in-podlove-handle)