CVE-2026-104388

Executive Summary

CVE-2026-104388 is a Missing Authorization (CWE-862) vulnerability in the Blubrry PowerPress Podcasting WordPress plugin, affecting all versions through 11.17.9. Because the flaw permits retrieval of embedded sensitive data without an authorization check, an unauthenticated remote attacker can potentially expose information the plugin was expected to protect. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), with the confidentiality-only impact driven by network reachability and no required privileges or user interaction.

Technical Analysis

The vulnerability is classified as Missing Authorization (CWE-862), which means the affected code path performs a sensitive action — here, retrieval of embedded sensitive data — without verifying that the requesting principal holds the required capability or nonce. In WordPress plugin architecture this class of bug typically manifests when a registered AJAX action, REST route, or admin-ajax handler omits a current_user_can() capability check, a check_ajax_referer()/nonce validation, or both, allowing unauthenticated or low-privileged callers to invoke functionality intended for authenticated administrators.

The NVD description states that the issue "allows Retrieve Embedded Sensitive Data" and affects "PowerPress Podcasting: from n/a through 11.17.9." No further code-level detail — no function names, hook names, REST namespaces, parameter names, or file paths — is provided in the available data. Accordingly, the precise endpoint and the exact nature of the "embedded sensitive data" cannot be confirmed from the supplied intelligence and are not asserted here.

What can be stated with confidence from the vulnerability class: the exposure is a confidentiality-only weakness (CVSS impact subscore C:L, with I:N and A:N). The attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N). This profile is consistent with an unauthenticated HTTP request to a plugin endpoint that returns data the application did not intend to disclose to anonymous callers. Because the scope is unchanged (S:U), the impact is confined to the vulnerable plugin's own security context rather than crossing a trust boundary into the broader host.

The CWE-862 designation distinguishes this from CWE-863 (Incorrect Authorization), which would imply an authorization check exists but is flawed. CWE-862 indicates the check is absent or effectively absent for the relevant action. In practice this means any party able to reach the vulnerable endpoint can trigger the data retrieval, subject only to network reachability of the WordPress instance.

No patch evidence exists from any tracked source (Patch Confidence 0/4), no public proof-of-concept, Nuclei template, or exploit code is available, and the CVE has not been added to CISA KEV. The EPSS score has not been published by FIRST.org and is deliberately not estimated here.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level only. No public PoC is available; the chain is inferred from the CWE-862 class and the CVSS profile. Specific function names, routes, and parameters are intentionally omitted because they do not appear in the source data.

1. Reconnaissance / target identification. An attacker enumerates internet-facing WordPress installations and fingerprints the PowerPress plugin, for example by requesting known plugin asset paths under /wp-content/plugins/powerpress/ or by checking page source for plugin-generated markup. Mass scanning for the plugin's presence is trivial and requires no authentication.

2. Triggering the flaw. The attacker issues a direct HTTP request to the plugin functionality that performs the sensitive data retrieval. Because the missing authorization check (CWE-862) is absent rather than misconfigured, the request succeeds without any session cookie, API key, or capability. No user interaction (UI:N) and no prior authentication (PR:N) are required; the request is a standard network call (AV:N) with low complexity (AC:L).

3. Payload / execution method. At the vulnerability-class level, exploitation here is a data-retrieval action rather than code execution. The attacker submits a crafted request that causes the plugin to return embedded sensitive data. No memory corruption, injection, or upload primitive is implied by CWE-862 or the confidentiality-only CVSS vector. Unlike SQL injection or RCE, the "payload" is simply a request that the application should have rejected but does not.

4. Post-exploitation impact. Successful exploitation yields disclosure of whatever the plugin embedded and was expected to protect. Given the C:L confidentiality subscore, the exposure is limited but not necessarily trivial — leaked secrets, tokens, or internal configuration can seed follow-on attacks. With I:N and A:N, there is no direct data modification or service disruption. A typical follow-on pattern would use disclosed credentials or configuration to pivot to adjacent systems, though any such escalation would rely on the disclosed material rather than on this CVE itself.

Impact Assessment

The direct business impact is information disclosure. With a CVSS v3.1 base score of 5.3 (Medium), the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N describes a vulnerability that is easy to reach and trigger but bounded in effect: only confidentiality is affected, and only at a Low level. Integrity and availability are unaffected, and the scope is unchanged, so the blast radius is confined to the vulnerable plugin's data rather than the host, other tenants, or the underlying database engine.

Affected systems are WordPress deployments running the Blubrry PowerPress Podcasting plugin at version 11.17.9 or earlier. Organizations that publish podcasts through WordPress are the primary exposed population. Hosting providers, media companies, educational institutions, and any entity running the plugin on an internet-reachable site should treat the instance as affected until a fixed version is confirmed.

Because no patch exists and no exploit code is public, current real-world risk is tempered by the absence of weaponization. However, the combination of network reachability, no authentication requirement, and low attack complexity means that once a proof-of-concept surfaces, weaponization and opportunistic mass scanning are likely. The unpatched status (0/4 patch confidence) raises the priority of compensating controls even at a Medium severity rating.

Detection Guidance

Sigma Rule

title: Potential Blubrry PowerPress Unauthenticated Sensitive Data Retrieval (CVE-2026-104388)
id: 8f3a2c1e-4b7d-4e9a-9c2f-1d6e5a7b3f04
status: experimental
description: Detects HTTP requests to WordPress PowerPress plugin endpoints that may indicate exploitation of CVE-2026-104388 (missing authorization leading to embedded sensitive data retrieval).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104388
author: valtersit.com
date: 2026/01/15
tags:
  - attack.t1190
  - cve.2026-104388
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-uri-stem|contains:
      - '/wp-content/plugins/powerpress/'
      - '/wp-json/powerpress'
      - 'powerpress'
  selection_unauth:
    cs-uri-query|contains:
      - 'action='
      - 'powerpress'
  condition: selection_plugin and selection_unauth
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate authenticated PowerPress plugin usage
  - Plugin asset loading by normal site visitors
level: medium

YARA Rule

rule CVE_2026_104388_PowerPress_Missing_Authz
{
    meta:
        description = "Detects PowerPress Podcasting plugin versions at or below 11.17.9 susceptible to CVE-2026-104388 (missing authorization, embedded sensitive data retrieval)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104388"
        date = "2026-01-15"
        severity = "medium"

    strings:
        $plugin_header = "Plugin Name: PowerPress" ascii nocase
        $slug1 = "powerpress/powerpress.php" ascii nocase
        $slug2 = "powerpress" ascii nocase
        $ver = /Version:\s*11\.(1[0-7]|[0-9])\./ ascii

    condition:
        $plugin_header and $slug1 and $ver
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104388 Blubrry PowerPress Unauthenticated Sensitive Data Retrieval Attempt"; flow:established,to_server; http.uri; content:"/wp-content/plugins/powerpress/"; nocase; http.uri; content:"action="; nocase; reference:cve,2026-104388; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104388; classtype:attempted-recon; sid:2026104388; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" and
  /* PowerPress plugin endpoint access without an authenticated session */
  (startsWith(http.request.uri, "/wp-content/plugins/powerpress/") or
   contains(http.request.uri, "/powerpress") or
   contains(http.request.uri, "/wp-json/powerpress")) and
  not endsWith(http.request.uri, ".css") and
  not endsWith(http.request.uri, ".js") and
  not endsWith(http.request.uri, ".png") and
  not endsWith(http.request.uri, ".jpg")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx OR sourcetype=iis
(uri_path="*/wp-content/plugins/powerpress/*" OR uri_path="*/wp-json/powerpress*" OR uri_query="*powerpress*")
NOT (uri_path="*.css" OR uri_path="*.js" OR uri_path="*.png" OR uri_path="*.jpg" OR uri_path="*.gif")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(uri_query) as queries by clientip
| where count > 5
| sort -count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-104388,">
  <rule id="104388" level="8">
    <if_sid>31100</if_sid>
    <id>^GET</id>
    <url>/wp-content/plugins/powerpress/</url>
    <description>CVE-2026-104388: Possible PowerPress missing authorization - unauthenticated access to plugin endpoint attempting embedded sensitive data retrieval.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104388,attack</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No vendor fix, patched version, or workaround is identified in any tracked source, and no patch evidence was found across the sources consulted. Organizations cannot rely on an upgrade path at this time.

1) Immediate mitigations

• Treat all PowerPress installations through 11.17.9 as exposed. If podcasting functionality is not required on a host, disable and remove the plugin to eliminate the attack surface.
• Where the plugin must remain active, restrict network access to the vulnerable functionality at the edge. Use a WAF or reverse-proxy rule to block unauthenticated requests to the plugin's data-handling endpoints, and enforce authenticated access.
• Harden the WordPress perimeter: apply generic virtual patching for missing-authorization patterns, rate-limit anonymous API and admin-ajax/REST traffic, and monitor for anomalous retrieval of plugin data.
• Inventory all WordPress instances running PowerPress and confirm which are internet-reachable; prioritize remediation on any that handle sensitive embedded configuration.

2) Patch/upgrade steps

• No patched release has been confirmed. Monitor the Blubrry PowerPress plugin changelog and the WordPress plugin repository for a version exceeding 11.17.9.
• Subscribe to NVD and vendor channels for CVE-2026-104388 status changes; re-evaluate patch confidence immediately when a fix version is published.
• When a fixed release becomes available, stage and test it in a non-production environment, then roll out promptly, verifying the deployed version supersedes 11.17.9.

3) Long-term hardening

• Enforce least-privilege and consistent authorization checks across plugins; adopt a code review standard requiring capability and nonce validation on every sensitive endpoint.
• Maintain a continuous software bill of materials for WordPress plugins and monitor for missing-authorization (CWE-862) advisories affecting any installed component.
• Deploy the detection rules in this report and tune them against baseline traffic to reduce false positives while retaining coverage for unauthenticated plugin-endpoint access.
• Ensure logging of full request URIs, query strings, and client IPs at the web tier so that attempts can be reconstructed during incident response.

References

• NVD — CVE-2026-104388: https://nvd.nist.gov/vuln/detail/CVE-2026-104388
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Blubrry PowerPress Podcasting plugin (WordPress.org): https://wordpress.org/plugins/powerpress/
• FIRST.org EPSS (score not yet assigned for this CVE): https://www.first.org/epss/

No threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-104388 at this time. The CVE is not listed in CISA KEV, and no public PoC, Nuclei template, or exploit code has been identified.