High severity7.1NVD Advisory· Published Aug 12, 2026· Updated Aug 26, 2026
CVE-2026-16294
CVE-2026-16294
Description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <11.17.1
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)Wordfence Blog · Aug 21, 2026