High severity8.8NVD Advisory· Published Aug 18, 2017· Updated Jun 17, 2026

CVE-2017-12949

Description

lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF.

Affected products

Podlove/Podlove Podcast Publisher
cpe:2.3:a:podlove:podlove_podcast_publisher:2.5.3:*:*:*:*:*:*:*
WordPress/Podlove Podcast Publisherllm-fuzzy
Range: <=2.5.3

Patches

Vulnerability mechanics

References

www.defensecode.com/advisories/DC-2017-05-006_WordPress_Podlove_Podcast_Publisher_Plugin_Advisory.pdfnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000