Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function

Vulnerability

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 4.2.2 [1]. The issue resides in the ajax_transcript_delete() function, which lacks proper nonce validation. This makes the function susceptible to CSRF attacks, enabling an attacker to trick a site administrator into performing unintended actions.

Exploitation

An unauthenticated attacker can exploit this vulnerability by crafting a malicious request that deletes arbitrary episode transcripts. The attacker must trick a site administrator (with appropriate permissions) into performing an action, such as clicking on a crafted link. No prior authentication or special network access is required for the attacker, only the ability to deliver the forged request to a logged-in administrator.

Impact

Successful exploitation allows an attacker to delete arbitrary episode transcripts from the WordPress site. This results in a loss of data availability, potentially disrupting the podcast content and the user experience. The attacker gains no direct code execution or privilege escalation, but data deletion can have significant operational impact.

Mitigation

The vendor has released version 4.5.0 (last updated 2026-05-15) which likely contains the fix, though the reference does not explicitly confirm CSRF protections [1]. Users should update to the latest version (4.5.0 or higher) as soon as possible. No workaround is documented; the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.