Executive brief
Podigee is a WordPress plugin used to integrate podcasting services into websites. A security flaw in this plugin allows an attacker to force the website to make unauthorized requests to other servers. This could be used to scan internal networks or access sensitive information from other services running on the same system that are not normally exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Podigee plugin for WordPress (versions <= 1.4.0). The flaw allows unauthenticated remote attackers to induce the server to execute web requests to arbitrary domains. This is typically caused by insufficient validation of user-supplied URLs before the server fetches them. An attacker can leverage this to perform internal port scanning, interact with internal services behind a firewall, or potentially leak sensitive metadata. As of the advisory date, no official patch has been released.
Affected products
- Podigee Podigee <= 1.4.0
Timeline
- 2026-01-27: other: Vulnerability reported by researcher Nabil Irawan
- 2026-02-26: advisory: Initial advisory published by Patchstack
- 2026-04-08: disclosed: CVE published to NVD