# CVE-2026-97354: PowerPress Podcasting plugin SSRF via redirect validation

Source: https://junglewise.ai/threats/cve-2026-97354-the-powerpress-podcasting-plugin-by-blubrry-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-97354 · Severity: info · Published 2026-10-07

The PowerPress Podcasting plugin for WordPress, used to publish and manage podcast content, fails to validate where media URL fetches redirect to. An attacker with contributor-level access can exploit this to send requests from the website server to internal systems, potentially exposing sensitive data or triggering unauthorized actions on internal services.

Technologies: [Blubrry PowerPress Podcasting](https://junglewise.ai/threats/technologies/blubrry-powerpress-podcasting). Vendors: [Blubrry](https://junglewise.ai/threats/vendors/blubrry).

## Quick answers

**Is CVE-2026-97354 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97354 being exploited in the wild.

**How severe is CVE-2026-97354?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** Blubrry PowerPress Podcasting 11.13.12 to 11.17.9.

**Is there a fix for CVE-2026-97354?** Yes: fixed in 11.17.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97354 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97354?** Check whether you run Blubrry PowerPress Podcasting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.17.11

## Technical details

The plugin accepts user-supplied media URLs without validating redirect destinations during fetch operations, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker with contributor role or above can craft a redirect chain to reach internal services. This is CWE-918 (Improper Restriction of Rendered UI Layers or Frames) and requires the attacker to have an existing contributor account on the WordPress instance.

## Affected products

- Blubrry PowerPress Podcasting 11.13.12 to 11.17.9

## Timeline

- 2026-10-05: disclosed
- 2026-10-07: advisory

## References

- [https://wpscan.com/vulnerability/473239c2-0b66-466b-98ac-391dad2853b9/](https://wpscan.com/vulnerability/473239c2-0b66-466b-98ac-391dad2853b9/)

## Related threats

- [Blubrry PowerPress Podcasting broken access control](https://junglewise.ai/threats/cve-2026-125782-missing-authorization-vulnerability-in-blubrry-podcasting)
- [Blubrry PowerPress Podcasting broken access control](https://junglewise.ai/threats/cve-2026-121766-missing-authorization-vulnerability-in-blubrry-podcasting)
- [Blubrry PowerPress Podcasting cross-site request forgery](https://junglewise.ai/threats/cve-2026-121762-cross-site-request-forgery-csrf-vulnerability-in-blubrry)
- [PowerPress Podcasting broken access control](https://junglewise.ai/threats/cve-2026-104387-unauthenticated-broken-access-control-in-powerpress-podcasting)
- [PowerPress Podcasting plugin stored cross-site scripting in block attribute](https://junglewise.ai/threats/cve-2026-97319-the-powerpress-podcasting-plugin-by-blubrry-wordpress-plugin)