CVE-2026-13729 — MEDIUM (4.3)

Vulnerability Description

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-352

References

https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/

FAQ

What is CVE-2026-13729?

CVE-2026-13729 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or del...

How severe is CVE-2026-13729?

CVE-2026-13729 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-13729?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.