CVE-2026-24637: WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability

Synopsis

SQL injection vulnerability in the PowerPress Podcasting plugin for WordPress, affecting versions 11.15.10 and earlier. The vulnerability is reachable over the network and requires only a low-privilege contributor-level account, with no additional user interaction needed. Successful exploitation gives an attacker read access to sensitive data stored in the WordPress database and can cause limited disruption to availability. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege WordPress account at the Contributor role or above is sufficient to trigger the injection; no administrative access is needed.

• Victim interactionNot required

  The attacker can send the malicious request directly without any action required from another user.

• Attack complexityDetail

  Exploitation is reliable and imposes no special conditions, timing requirements, or environmental dependencies.

Blast Radius

• Reads arbitrary rows from the WordPress database, including stored user credentials, email addresses, session tokens, and private post content.
• Can extract plugin and theme configuration data, API keys, or other sensitive values stored in the wp_options table.
• Causes limited availability impact, such as degraded database query performance or minor service disruption, under the A:L rating.