CVE-2026-104407

Executive Summary

CVE-2026-104407 is a Cross-Site Request Forgery (CSRF) vulnerability in the Blubrry PowerPress Podcasting WordPress plugin, affecting all versions up to and including 11.17.9. An unauthenticated remote attacker can induce a logged-in privileged user (administrator, editor, or podcast manager) to submit forged requests to the WordPress site, causing state-changing actions to execute under the victim's authenticated session without their intention. With a CVSS base score of 7.1 and a Scope:Changed vector, the flaw can impact resources beyond the vulnerable component, making cross-tenant or cross-context abuse plausible.

Technical Analysis

The vulnerability is classified as CWE-352: Cross-Site Request Forgery. CSRF arises when a web application performs state-changing operations based on HTTP requests without verifying that the request originated from the application's own trusted origin, and without requiring an unpredictable, unguessable token tied to the user's session. The NVD description confirms PowerPress Podcasting does not sufficiently enforce such anti-CSRF protections in at least one of its request-handling paths.

The attack surface is administrative/authenticated functionality within the plugin. The plugin exposes request handling routines reachable over the network (AV:N, PR:N in the vector, meaning no prior authentication is required to initiate the request chain, though UI:R indicates a victim user must be socially engineered into triggering the request). Because the CVSS vector carries S:C (Scope Changed), successful exploitation can affect security controls or resources outside the original vulnerable component — for example, altering site-level settings or content managed by other WordPress components. The integrity and confidentiality impact are each rated Low, and availability Low, consistent with a forged request performing a limited, targeted change rather than full system compromise.

Important accuracy note: the NVD description and CNA metadata provided do not disclose the specific vulnerable parameter, endpoint, function name, or request action. Accordingly, no specific AJAX action names, nonces, REST route paths, or handler function names are asserted in this report. What is known from the data is only the vulnerability class (CSRF) and the affected product/version range.

The absence of any vendor patch, OSV package mapping, or affected-version advisory beyond the range "from n/a through 11.17.9" means defenders must treat the entire plugin installation base at or below 11.17.9 as exposed.

Exploitation Scenarios

No public PoC or Nuclei template is available; the attack chain below is inferred strictly from the CSRF vulnerability class and the supplied metadata. No concrete parameter names or endpoints are invented.

1. Reconnaissance / target identification. The attacker identifies WordPress sites running the Blubrry PowerPress Podcasting plugin at version 11.17.9 or earlier. Fingerprinting can leverage publicly served plugin asset paths and page markup; the Shodan dorks provided above assist in bulk identification of WordPress/PowerPress deployments.

2. Triggering the flaw class. The attacker crafts a malicious page or link that, when loaded by an authenticated victim, causes the victim's browser to automatically issue an HTTP request to the target WordPress site. Because the vulnerable request path lacks effective anti-CSRF validation, the WordPress application cannot distinguish this forged request from a legitimate user-initiated action and processes it using the victim's active session cookies.

3. Payload / execution method at the class level. CSRF exploitation is delivered via social engineering: the victim (a logged-in privileged user) visits attacker-controlled content or clicks a crafted link. The forged request carries the victim's ambient session credentials automatically. No user credentials are stolen; the session itself is abused.

4. Post-exploitation impact. Any state-changing action reachable through the vulnerable request path can be executed as the victim. Given S:C and Low C/I/A subscores, plausible outcomes include unauthorized modification of plugin configuration or site content, or other limited configuration changes within the scope of the victim's privileges. The precise action set is not enumerated in the available intelligence and should not be assumed.

Impact Assessment

• CVSS 3.1 Base: 7.1 (High). AV:N — remotely reachable; AC:L — no special conditions; PR:N — attacker needs no account on the target; UI:R — requires a victim to perform a user interaction; S:C — impact may extend beyond the vulnerable component; C:L / I:L / A:L — limited confidentiality, integrity, and availability impact.
• Business impact: unauthorized configuration or content changes on production WordPress sites can disrupt podcast publishing workflows, damage brand trust, and open the door to follow-on abuse of changed settings. Scope:Changed raises the possibility of affecting components or trust boundaries beyond the plugin itself.
• Blast radius: every WordPress installation running PowerPress Podcasting ≤ 11.17.9 with authenticated users who can be socially engineered. Because the flaw targets authenticated sessions, the practical attacker goal is to coerce a privileged user, not to exploit anonymous visitors directly.
• EPSS: not yet scored by FIRST.org; no exploit-in-the-wild or CISA KEV evidence is present in the provided data.

Detection Guidance

Sigma Rule

title: Potential PowerPress Podcasting CSRF Exploitation Attempt
id: 5f1a9c2e-3b7d-4a10-9e42-8c6d1f0b7a55
status: experimental
description: Detects suspicious cross-origin or referer-less state-changing requests targeting WordPress sites running the PowerPress Podcasting plugin (<= 11.17.9).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104407
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'powerpress'
      - 'PowerPress'
  selection_method:
    cs-method:
      - 'POST'
      - 'GET'
  filter_referer:
    cs-referer: null
  condition: selection_plugin and selection_method and filter_referer
fields:
  - c-ip
  - cs-uri
  - cs-referer
  - cs-user-agent
falsepositives:
  - Legitimate plugin requests from privacy-stripping proxies
  - Direct API or CLI clients
level: medium
tags:
  - attack.t1204.001
  - cve.2026.104407

YARA Rule

rule CVE_2026_104407_PowerPress_CSRF_HTML
{
    meta:
        description = "Detects HTML pages that embed cross-origin forms or links targeting PowerPress Podcasting plugin requests (CSRF lure pages)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104407"
        cve = "CVE-2026-104407"

    strings:
        $pp1 = "powerpress" nocase
        $pp2 = "PowerPress" nocase
        $form1 = "<form" nocase
        $form2 = "method=\"post\"" nocase
        $js1 = "document.forms" nocase
        $js2 = ".submit()" nocase
        $img = "<img" nocase
        $onerr = "onerror=" nocase

    condition:
        filesize < 512KB and
        ($pp1 or $pp2) and
        (
            ($form1 and $form2) or
            ($js1 and $js2) or
            ($img and $onerr)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104407 PowerPress Podcasting CSRF Attempt (State-Changing Request Without Referer)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"powerpress"; nocase; http.referer; content:!"!"; reference:cve,2026-104407; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104407; classtype:web-application-attack; sid:2026104407; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET" and http.request.referrer == null and url.full : "powerpress*" ]
  [ network where http.request.method == "POST" and http.request.referrer == null and url.full : "powerpress*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri)
| where (like(uri_lower, "%powerpress%") OR like(uri_lower, "%power-press%"))
| where (method="POST" OR method="GET")
| eval has_referer = if(len(referer)>0 AND referer!="-", 1, 0)
| where has_referer=0
| stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods values(uri) as uris by src_ip, host
| where count > 3
| sort - count
| table src_ip, host, methods, uris, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="web,wordpress,powerpress,">
  <rule id="2026104" level="10">
    <if_sid>31100,31101,31108</if_sid>
    <match>powerpress|PowerPress</match>
    <regex>POST|GET</regex>
    <description>CVE-2026-104407: Possible PowerPress Podcasting CSRF state-changing request without valid referer</description>
    <mitre>
      <id>T1204.001</id>
    </mitre>
    <group>cve_2026_104407,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or tracked patch reference is available in the intelligence provided.

1. Immediate mitigations:

   • If the plugin is not operationally required, deactivate and remove PowerPress Podcasting until a fixed version is released.
   • Enforce SameSite=Lax or SameSite=Strict on WordPress session cookies to reduce cross-site request forgery effectiveness for authenticated sessions.
   • Add an edge/WAF rule rejecting state-changing requests to plugin paths that carry no valid Origin or Referer header, and that originate from unexpected origins.
   • Restrict administrative access to WordPress dashboards by source IP or VPN, reducing the population of users who can be socially engineered while authenticated.
   • Train privileged users against clicking untrusted links while logged in; enforce short administrative session lifetimes.

2. Patch / upgrade steps:

   • No patched release is confirmed. Monitor the vendor (Blubrry) and the WordPress plugin repository for a fixed version above 11.17.9, and upgrade immediately once published.
   • Until then, treat all installations at ≤ 11.17.9 as unpatched.

3. Long-term hardening:

   • Require anti-CSRF tokens on all state-changing plugin endpoints; validate Origin/Referer server-side on WordPress admin-post.php, admin-ajax.php, and REST routes.
   • Adopt a least-privilege role model; limit the number of accounts permitted to modify plugin settings.
   • Maintain an inventory of WordPress plugins with version tracking so future advisories can be actioned within SLA.

References

• NVD — CVE-2026-104407: https://nvd.nist.gov/vuln/detail/CVE-2026-104407
• MITRE CWE-352 (Cross-Site Request Forgery): https://cwe.mitre.org/data/definitions/352.html
• OWASP — Cross-Site Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
• Blubrry PowerPress Podcasting (vendor/product site for patch monitoring): https://blubrry.com/
• CISA KEV Catalog (no entry for CVE-2026-104407 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, or exploit code was identified. No threat actor campaign or exploit-in-the-wild evidence is present in the provided intelligence.