CVE-2026-16294

Executive Summary

CVE-2026-16294 is a Server-Side Request Forgery (SSRF) vulnerability in the PowerPress Podcasting plugin by Blubrry for WordPress, affecting versions prior to 11.17.1. The flaw resides in an unvalidated Podcast Episode URL setting, which allows authenticated users with Contributor-level privileges or higher to trigger server-side requests to arbitrary internal services. With a CVSS score of 7.1 (High), the vulnerability enables an attacker to probe internal network infrastructure, read sensitive data from internal endpoints, and potentially manipulate internal resources. No patch is currently available from any tracked source, leaving all installations running versions below 11.17.1 exposed.

Technical Analysis

The PowerPress Podcasting plugin by Blubrry is a widely deployed WordPress plugin used to manage podcast feeds, episode metadata, and media distribution. The vulnerability stems from insufficient server-side validation of one of the "Podcast Episode URL" settings during the plugin's episode ingestion or feed-processing workflow.

Vulnerability Class and Mechanism:
The issue falls under CWE-918 (Server-Side Request Forgery). At its core, the plugin accepts a URL supplied through an administrative interface (the episode URL settings) and subsequently performs an HTTP request to that URL from the server. Under normal operation, this URL is expected to point to a podcast media file (e.g., an MP3 hosted on a public CDN). However, the plugin fails to validate the target host, scheme, or port range before issuing the request.

This lack of validation permits a malicious actor to supply a URL pointing to internal network resources, such as:

• RFC 1918 private IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Link-local addresses (169.254.0.0/16)
• Localhost (127.0.0.1 or ::1)
• Cloud metadata services (e.g., 169.254.169.254 on AWS/GCP)
• Internal service hostnames resolvable only from the server's network

Attack Surface and Privilege Requirements:
The NVD description notes that the attacker requires a role "as low as Contributor." In WordPress, Contributors can create posts and upload files, but do not typically hold administrative privileges over plugin settings. This implies the vulnerable URL parameter is present in an interface accessible to lower-privileged users, potentially through a custom post type or a dedicated episode submission form that the plugin registers. The CVSS vector confirms this with PR:L (Privileges Required: Low).

Technical Limitation on Detail:
The NVD description does not specify the exact parameter name, UI field identifier, or the precise code path where the request is executed. No patch, vendor advisory, or researcher write-up is available from tracked sources to supplement this detail. Consequently, the exact function names, API endpoints, and database option keys remain unknown. Analysis must therefore describe the mechanism at the vulnerability-class level.

Request Execution and Response Handling:
The SSRF likely manifests when the plugin fetches the submitted URL to validate the episode file's existence, extract metadata (e.g., file size, duration, MIME type), or generate a preview. The request is carried out with the web server's privileges. When the target responds, the plugin may:

• Return the response content in the admin UI (full/partial SSRF), or
• Only provide success/failure status (blind SSRF)

Given the CVSS confidentiality impact rating of C:H (High) and integrity impact of I:L (Low), at least a portion of the response is likely reflected back to the user or stored and displayed, enabling data exfiltration from internal services.

Exploitation Scenarios

No public PoC or exploit code is available. The following attack chain is inferred from the vulnerability class (CWE-918) and the stated privilege requirements.

Step 1 — Reconnaissance and Target Identification
An attacker must first authenticate to a WordPress instance running PowerPress < 11.17.1 with an account that holds at least the Contributor role. Contributors can be created through standard WordPress user registration flow if open registration is enabled, or through social engineering/phishing to obtain a Contributor account. Alternatively, a lower-privileged user could escalate if another vulnerability exists; however, for this CVE, the described role is sufficient.

Step 2 — Triggering the Flaw (Request Preparation)
The attacker navigates to the episode editor/submission interface where the "Podcast Episode URL" setting is present. Instead of supplying a legitimate podcast file URL (e.g., https://cdn.example.com/episode.mp3), the attacker provides an internal target URL. Examples:

• http://127.0.0.1:8080/admin — probing a local admin panel
• http://169.254.169.254/latest/meta-data/ — AWS/GCP metadata service discovery
• http://10.0.0.5:3306 — internal database port scan
• file:///etc/passwd — local file access (if the library supports custom schemes)

Step 3 — Payload Delivery and Execution
The plugin accepts the URL without validating the scheme, host, or port. Upon saving the episode or triggering a preview/metadata-fetch action, the server initiates an outbound connection to the attacker-specified address. The request is sent with the web application's HTTP client stack, and any response is processed by the plugin. If the plugin reflects the response body (e.g., in an error message or a preview box), the attacker observes the internal service's output.

Step 4 — Post-Exploitation Impact
Successful exploitation enables:

• Internal Port Scanning: Repeated requests to sequential IP addresses and ports map the internal network topology.
• Cloud Metadata Exfiltration: Fetching credentials, API tokens, and instance metadata from the cloud provider's metadata endpoint (169.254.169.254).
• Access to Internal Services: Read data from internal web apps (e.g., Jenkins, Grafana, Elasticsearch) accessible only from the host network.
• Potential Integrity Damage (I:L): A low-integrity impact suggests the attacker might be able to modify specific internal resources (e.g., writing to a misconfigured internal API endpoint) but not broadly alter data.

Because the attacker requires valid credentials, this is not a remote unauthenticated exploit. However, the low-privileged Contributor role makes the attack surface relatively wide — any compromise of a low-privilege account, or open registration on the site, is sufficient to launch the attack.

Impact Assessment

Business Impact:

• Data Confidentiality Breach (C:H): Attackers can read internal service data, stored credentials, or cloud metadata. This may expose application source code, database connection strings, or administrative credentials.
• Limited Integrity Impact (I:L): In scenarios where internal services accept HTTP requests that produce state changes (e.g., a REST API without proper authorization), the attacker may be able to perform limited modification of internal data.
• Availability Impact (A:N): No availability impact is noted; the attack does not directly cause denial of service.

Affected Systems:

• All WordPress installations running PowerPress Podcasting plugin by Blubrry versions prior to 11.17.1.
• The blast radius includes the internal network behind the WordPress host, cloud metadata endpoints, and any service listening on loopback or private ranges.

CVSS Subscore Context:

• Attack Vector: Network (AV:N) — remote exploitation possible.
• Attack Complexity: Low (AC:L) — no special conditions required beyond valid credentials.
• Privileges Required: Low (PR:L) — Contributor role suffices.
• User Interaction: None (UI:N) — no victim interaction needed.
• Scope: Unchanged (S:U) — the compromise is contained to the server's network context.

Threat Actor Relevance:
Given the plugin's popularity among podcasters and the WordPress ecosystem, this vulnerability is likely to be scanned for and exploited by automated bots. The EPSS score of 0.00132 (3.2% percentile) indicates low current exploitation prevalence in the wild, but the score can rise rapidly once a public PoC or Metasploit module appears. No CISA KEV listing is available, indicating it is not yet a known exploited vulnerability.

Detection Guidance

Sigma Rule

title: PowerPress Plugin SSRF Attempt - Outbound Request to Private Network
id: 4d3a58c3-7d4f-4a1e-9c8b-83f61b1a7e21
status: experimental
description: Detects server-side requests to private IP ranges or loopback addresses originating from the WordPress/PowerPress process, indicative of CVE-2026-16294 SSRF exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16294
author: Valters IT Security Team
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: Requires logging of outbound requests from the web server to downstream services. Web server access logs may not capture outbound SSRF; use application or firewall logs.
detection:
    selection_http_method:
        cs-method: GET|POST
    selection_dest_ip:
        c-dest-ip:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
            - '::1'
    condition: selection_http_method and selection_dest_ip
    timeframe: 5m
level: high

YARA Rule

rule PowerPress_SSRF_Indicator
{
    meta:
        author = "Valters IT Security"
        description = "Detects SSRF patterns in PowerPress plugin source or web traffic captures"
        vulnerability = "CVE-2026-16294"
        cwe = "CWE-918"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16294"
        date = "2026-01-15"
    strings:
        $url_param = "podcast_episode_url" ascii nocase
        $http_call = "wp_remote_get" ascii nocase
        $curl_init = "curl_init" ascii nocase
        $private_ip = "192.168." ascii nocase
        $loopback = "127.0.0.1" ascii
        $metadata = "169.254.169.254" ascii
    condition:
        (uint16(0) == 0x5A4D or $url_param) and  // PE file MAGIC or presence of key param
        (1 of ($http_call, $curl_init)) and
        (any of ($private_ip, $loopback, $metadata))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-16294 - PowerPress SSRF to Internal Network (IP Range)"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/"; http_uri; content:"powerpress"; http_uri; content:"episode_url"; http_uri; content:"http://"; http_client_body; content:"10."; http_client_body; within:50; sid:2026162941; rev:1; reference:cve,2026-16294;)

Alternative rule based on destination IP (requires network visibility of outbound server requests):

alert ip any any -> [10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,169.254.0.0/16] any (msg:"CVE-2026-16294 - Potential SSRF from WordPress/PowerPress to Private Network"; flow:to_server; sid:2026162942; rev:1; reference:cve,2026-16294;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ network where destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16") and event.action == "connection_attempted" ]
  [ process where process.name : ("php", "php-fpm", "apache2", "httpd") and process.args : ("*powerpress*", "*episode_url*") ]

Splunk SPL Query

index=firewall OR index=proxy OR sourcetype=iis:access OR sourcetype=apache:access
| where (dst_ip LIKE "10.%" OR dst_ip LIKE "192.168.%" OR dst_ip LIKE "172.16%" OR dst_ip = "127.0.0.1" OR dst_ip = "169.254.169.254")
  AND (src_ip IN (web_server_ips))
  AND (uri LIKE "%powerpress%" OR uri LIKE "%episode_url%")
| table _time, src_ip, dst_ip, src_port, dest_port, uri, status
| sort - _time

Wazuh OSSEC Rule

<group name="ssrf,wordpress,">
  <rule id="492826" level="12">
    <decoded_as>json</decoded_as>
    <field name="dst_ip">^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.0\.0\.1|169\.254\.)</field>
    <field name="src_ip">\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b</field>
    <description>CVE-2026-16294: PowerPress SSRF detected - outbound request to private IP from $(src_ip) to $(dst_ip)</description>
    <group>ssrf,powershell,wordpress,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status:
Patch confidence is 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor (Blubrry) has not released version 11.17.1 as a fix, and no commit or advisory has been identified. It is possible the vendor has not yet acknowledged the vulnerability or is still developing a fix.

Immediate Mitigations (WAF/Firewall Level):

1. Deploy a Web Application Firewall (WAF) rule that blocks requests to the vulnerable "Podcast Episode URL" parameter containing internal IP address patterns (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x) or non-standard schemes (file://, gopher://).
2. Implement egress firewall rules on the web server's host to block outbound connections from the web application user (e.g., www-data) to all private IP ranges and loopback addresses. Permit only necessary external destinations.
3. Disable the feature if the "Podcast Episode URL" setting is not essential for the site's podcasting workflow. This may involve removing custom post type support or editing template files — a WordPress administrator with full plugin knowledge should evaluate this option.

Patch/Upgrade Steps:

1. Monitor the upstream plugin repository (https://wordpress.org/plugins/powerpress/) for version 11.17.1 or newer. As of this report, no such version exists; do not assume the current latest version is patched without confirmation.
2. Subscribe to Blubrry's security advisories and changelog for announcements regarding CVE-2026-16294.
3. When a patched version is released: upgrade via the WordPress admin dashboard (Plugins → Installed Plugins → Update) or via WP-CLI: wp plugin update powerpress --version=11.17.1

Long-Term Hardening:

1. Enforce least privilege: Disable open user registration on WordPress sites; require identity verification before granting Contributor roles. Audit existing Contributor accounts.
2. Implement network segmentation: Isolate the WordPress server from critical internal services. If the web server must access internal APIs, enforce allowlists of specific IPs and ports.
3. Use a secure proxy for all outbound HTTP requests within the application stack — a proxy that strips requests to private IP ranges acts as a safety net even if plugin-level validation is flawed.
4. Enable Cloud Provider security features: If hosted on AWS/GCP/Azure, use IMDSv2 (Instance Metadata Service Version 2) with session-based tokens to prevent unauthorized metadata access via SSRF.
5. Run regular vulnerability scanning for WordPress plugins and apply patches promptly to the entire plugin stack, not just this plugin.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16294
2. WordPress Plugin Repository (PowerPress Podcasting by Blubrry): https://wordpress.org/plugins/powerpress/
3. Mitre ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
5. CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence exists for this CVE at the time of writing. The EPSS score (0.00132, 3.2% percentile) indicates low real-world exploitation prevalence. CISA KEV listing status is NO. Monitoring should continue for emergent campaigns once a PoC is released.