CVE-2026-13729: Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13729?
CVE-2026-13729 has a medium severity rating of 4.3 according to the CVSS 3.1 scoring.
How do I fix CVE-2026-13729?
To fix CVE-2026-13729, update the Podlove Podcast Publisher plugin to version 4.5.3 or later.
What kind of vulnerability is CVE-2026-13729?
CVE-2026-13729 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Podlove Podcast Publisher plugin.
What actions can be exploited in CVE-2026-13729?
CVE-2026-13729 can be exploited to create or delete podcast contributor, group, or role records without proper nonce validation.
Who is affected by CVE-2026-13729?
Administrators using versions of the Podlove Podcast Publisher plugin prior to 4.5.3 are affected by CVE-2026-13729.