Is CVE-2026-39505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39505 being exploited in the wild.

How severe is CVE-2026-39505?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

Castos Seriously Simple Podcasting <= 3.14.2.

Is there a fix for CVE-2026-39505?

A patch was published on 2026-03-26: Version 3.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39505 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39505?

Check whether you run Castos Seriously Simple Podcasting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39505: Craig Hewitt Seriously Simple Podcasting missing authorization

Q: Is there a fix for CVE-2026-39505?

A patch was published on 2026-03-26: Version 3.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39505 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-39505?

Check whether you run Castos Seriously Simple Podcasting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39505 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Seriously Simple Podcasting is a popular WordPress plugin used to manage and host podcast content directly from a website. A security flaw in the plugin's access control settings could allow unauthorized individuals to access information or perform actions that should be restricted to administrators. This could lead to the exposure of internal data or unauthorized changes to podcast configurations.

Technologies: Castos Seriously Simple Podcasting. Vendors: Castos.

Quick answers

Is CVE-2026-39505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39505 being exploited in the wild.
How severe is CVE-2026-39505?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: Castos Seriously Simple Podcasting <= 3.14.2.
Is there a fix for CVE-2026-39505?: A patch was published on 2026-03-26: Version 3.14.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39505 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39505?: Check whether you run Castos Seriously Simple Podcasting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization (CWE-862) vulnerability exists in the Seriously Simple Podcasting plugin for WordPress in versions up to and including 3.14.2. The flaw stems from a failure to properly validate user permissions or implement sufficient nonce checks on certain functions, leading to broken access control. An unauthenticated remote attacker can exploit this to perform actions or access data that should require higher privilege levels. The issue is resolved in version 3.14.3.

Affected products

Craig Hewitt (Castos) Seriously Simple Podcasting <= 3.14.2

Timeline

2026-02-24: other: Reported by hivesec
2026-03-26: advisory: Patchstack advisory published
2026-04-08: disclosed: CVE published
2026-03-26: patched: Version 3.14.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.