CVE-2026-97354

Executive Summary

CVE-2026-97354 is a Server-Side Request Forgery (SSRF) vulnerability in the Blubrry PowerPress Podcasting WordPress plugin affecting versions prior to 11.17.11. The flaw arises because the plugin does not validate the destination of redirects when fetching a user-supplied media URL, enabling authenticated users with the contributor role or higher to coerce the server into making requests to internal services. The CVSS 3.1 base score is 4.1 (Medium), reflecting high privileges required and limited confidentiality impact, but the changed scope (S:C) means the vulnerable component can affect resources beyond its security authority — the internal network.

Technical Analysis

The vulnerability class is CWE-918, Server-Side Request Forgery. Per the NVD description, the PowerPress Podcasting plugin by Blubrry "does not validate the destination of redirects when fetching a user-supplied media URL." This identifies the specific failure mode: a redirect-following behavior combined with insufficient destination validation.

The attack surface is the plugin's media-URL fetching functionality, which is reachable by authenticated users with the contributor role and above. Because the plugin is a WordPress plugin, the vulnerable fetch routine operates within the web server's network context. When a user-supplied media URL responds with an HTTP redirect (e.g., a 3xx status with a Location header), the plugin follows that redirect without re-validating that the destination host is permissible. This permits a URL that initially points to an attacker-controlled or benign external host to redirect the request toward an internal address — such as loopback, private RFC 1918 ranges, or link-local metadata endpoints — that would otherwise be unreachable from outside.

The core weakness is the absence of a redirect destination allowlist or denylist check. A robust implementation would validate each hop's resolved host against internal/private IP ranges before issuing the follow-up request, or disable automatic redirect-following for user-controlled URLs. The description does not disclose the specific function, class, hook, or parameter name responsible for the fetch, nor the exact HTTP client library in use. No function names, endpoints, or code paths are specified in the NVD description, so those implementation details are not asserted here.

It is worth distinguishing the two-layer nature of the bug: the initial URL is user-supplied and therefore assumed to be a legitimate media reference; the flaw is that the redirect target is trusted implicitly. This makes the vulnerability a classic "redirect-based SSRF" and explains why the required privilege is contributor-level rather than anonymous — the contributor must be able to submit or influence a media URL that the plugin will fetch.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE, and no exploit-in-the-wild evidence has been reported. The following chain is inferred from the vulnerability class and the NVD description; it does not rely on any fabricated function names, endpoints, or parameters.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running the Blubrry PowerPress Podcasting plugin with a version earlier than 11.17.11. This can be done passively (page source references to plugin assets, feed output, or plugin metadata) or via search engines and Shodan-type scans matching plugin-specific HTML markers. The attacker then obtains or compromises an account with at least the contributor role, or registers one where open registration and role assignment permit.

2. Triggering the flaw. The attacker supplies a media URL through the plugin's media-URL input surface. That initial URL points to a host the attacker controls (or any external host that returns a redirect). The attacker's server responds with an HTTP redirect whose Location header targets an internal resource — for example, a loopback service, a private-range host, or a cloud instance metadata address. Because the plugin does not validate the redirect destination, it follows the redirect and performs the request from the server's network position.

3. Execution method at the vulnerability-class level. The attack is a blind or semi-blind SSRF: the internal response may be returned to the user, stored, or only observable through side channels (timing, error messages, response-size differences). At the class level, the attacker uses redirect-following to bypass any initial host allowlist that would have applied to the original user-supplied URL.

4. Post-exploitation impact. Successful exploitation allows interaction with internal services reachable from the WordPress host. Because scope is changed (S:C), the impacted authority extends beyond the plugin to internal network resources. Confidentiality impact is rated Low (C:L) and integrity/availability impacts are None (I:N/A:N under this vector), consistent with a read-oriented information-disclosure SSRF rather than a write or denial-of-service primitive. Typical outcomes include fingerprinting internal services, reading unauthenticated internal endpoints, and potentially accessing cloud metadata endpoints, depending on network configuration.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N, base score 4.1 (Medium). Interpretation of subscores:

• AV:N (Network): the vulnerable fetch is reachable over the network.
• AC:L (Low): no unusual conditions are required to trigger the redirect-following behavior.
• PR:H (High): the attacker must hold contributor role or above — a meaningful barrier, but one that is frequently attainable on multi-author blogs, community sites, and compromised accounts.
• UI:N (None): no victim interaction is required beyond the attacker's own authenticated action.
• S:C (Changed): the exploitation can affect resources beyond the vulnerable plugin's security scope, i.e., internal services.
• C:L (Low): limited confidentiality impact, consistent with SSRF information disclosure.
• I:N / A:N: no integrity or availability impact is asserted by the vendor's scoring.

Blast radius: any WordPress deployment running PowerPress before 11.17.11 with contributor-level accounts that can supply media URLs. The primary business risk is internal network reconnaissance and disclosure of data exposed by unauthenticated internal services. On cloud-hosted WordPress instances, redirect-based SSRF to instance metadata endpoints is a realistic and high-consequence concern despite the Medium score, because metadata credentials can amplify impact far beyond the C:L rating. No EPSS score has been assigned by FIRST.org at the time of writing, and the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Potential PowerPress SSRF via Redirected Media URL Fetch
id: 3c7f9a12-5b6e-4d21-9a4e-97354cve0001
status: experimental
description: Detects outgoing HTTP requests originating from WordPress/PowerPress media fetching that target private, loopback, or link-local addresses, consistent with CVE-2026-97354 SSRF.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97354
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1090
logsource:
  category: proxy
detection:
  selection_internal:
    dst_ip:
      - '127.0.0.0/8'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
  selection_context:
    url|contains:
      - 'powerpress'
      - 'media'
      - 'podcast'
  condition: selection_internal and selection_context
falsepositives:
  - Legitimate internal media fetches by administrators
level: medium

YARA Rule

rule CVE_2026_97354_PowerPress_SSRF_Redirect
{
    meta:
        description = "Detects PowerPress plugin code referencing media URL fetching without redirect destination validation (CVE-2026-97354)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97354"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pp1 = "powerpress" ascii nocase
        $pp2 = "blubrry" ascii nocase
        $fetch1 = "wp_remote_get" ascii
        $fetch2 = "wp_remote_request" ascii
        $redir1 = "-redirects" ascii
        $redir2 = "'redirection'" ascii
        $urlfield = "media_url" ascii nocase

    condition:
        uint32(0) == 0x3C3F7068 and
        $pp1 and
        ($fetch1 or $fetch2) and
        ($redir1 or $redir2 or $urlfield)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-97354 PowerPress SSRF - Media URL Fetch Redirect to Internal Range"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"powerpress"; nocase; http.header; content:"Location|3A|"; nocase; pcre:"/Location\x3a\s*https?:\/\/(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)/i"; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97354; classtype:attempted-recon; sid:973541; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [network where destination.port in (80, 443) and process.name in ("php", "php-fpm", "apache2", "nginx")]
  [network where destination.ip in ("127.0.0.1","169.254.169.254") or cidr_match(destination.ip, "10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")]

Splunk SPL Query

index=web OR index=proxy
| search (uri="*powerpress*" OR uri="*media*")
| where (dest_ip="127.0.0.1" OR dest_ip="169.254.169.254" OR cidr(dest_ip,"10.0.0.0/8") OR cidr(dest_ip,"172.16.0.0/12") OR cidr(dest_ip,"192.168.0.0/16"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri, dest_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,ssrf,">
  <rule id="973540" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.(127\.0\.0\.1|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)</field>
    <field name="url">powerpress|media</field>
    <description>CVE-2026-97354 - Possible PowerPress SSRF to internal address via redirected media URL</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf,cve_2026_97354,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (interim controls):

• Restrict media-URL submission to trusted roles only; audit and reduce the number of contributor-or-higher accounts, especially on multi-author or community-facing WordPress sites.
• Egress-filter the WordPress host at the network layer so it cannot reach loopback, RFC 1918 private ranges, or link-local/metadata addresses (e.g., block 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 outbound from the web tier).
• On cloud instances, enforce IMDSv2 and restrict metadata access with hop-limit controls where the platform supports it; this blocks the highest-consequence SSRF target.
• Monitor proxy, web, and firewall logs for outbound requests from the WordPress host to internal ranges, using the detection rules above.
• If PowerPress media fetching is not required, disable or remove the plugin pending a fix.

2. Patch/upgrade steps:

• The NVD description states the vulnerability affects versions "before 11.17.11." Upgrade the Blubrry PowerPress Podcasting plugin to 11.17.11 or later. No vendor advisory, patch reference, or vendor-confirmed fix source was tracked at the time of this report (patch confidence 0/4); validate the fixed version against the plugin's official release channel before relying on it.
• Because the plugin ships through the WordPress plugin ecosystem, verify the installed version in the WordPress admin and apply the update through the standard plugin update mechanism. Confirm the deployed version post-upgrade.
• Re-check any known-dependent or bundled components for the same redirect-validation weakness.

3. Long-term hardening:

• Enforce server-side validation of redirect destinations for any user-supplied URL fetch: resolve the host and reject loopback, private-range, and link-local targets before following each hop, or disable automatic redirect-following for user-supplied URLs.
• Adopt a least-privilege role model; ensure contributor accounts cannot trigger server-side fetches of arbitrary URLs unless explicitly required.
• Standardize egress segmentation for web tiers so SSRF cannot reach sensitive internal or metadata services.
• Maintain a plugin inventory and a patch-management cadence for WordPress and its extensions; track CVE feeds for plugins in use.
• Log and alert on 3xx redirects and internal-range fetch attempts to detect exploitation attempts irrespective of patch state.

References

• NVD — CVE-2026-97354: https://nvd.nist.gov/vuln/detail/CVE-2026-97354
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE ATT&CK T1090 — Proxy (redirect-based SSRF context): https://attack.mitre.org/techniques/T1090/
• CISA KEV Catalog (CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code was available. No known threat actor campaigns or exploit-in-the-wild evidence were identified for this CVE at the time of writing. FIRST.org had not assigned an EPSS score.