{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39505", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:47:50.136Z", "datePublished": "2026-04-08T08:30:13.629Z", "dateUpdated": "2026-04-10T18:02:32.423Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "seriously-simple-podcasting", "product": "Seriously Simple Podcasting", "vendor": "Craig Hewitt", "versions": [{"changes": [{"at": "3.14.3", "status": "unaffected"}], "lessThanOrEqual": "3.14.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "hivesec | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:29:01.705Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.</p>"}], "value": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:13.629Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-14-2-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T18:02:22.771171Z", "id": "CVE-2026-39505", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T18:02:32.423Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39505", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:02:22.771171Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T18:02:14.780Z"}}], "cna": {"title": "WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "hivesec | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Craig Hewitt", "product": "Seriously Simple Podcasting", "versions": [{"status": "affected", "changes": [{"at": "3.14.3", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.14.2"}], "packageName": "seriously-simple-podcasting", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-08T10:29:01.705Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-14-2-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:13.629Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39505", "state": "PUBLISHED", "dateUpdated": "2026-04-10T18:02:32.423Z", "dateReserved": "2026-04-07T10:47:50.136Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-04-08T08:30:13.629Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2."}], "id": "CVE-2026-39505", "lastModified": "2026-04-10T18:16:44.593", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-08T09:16:24.647", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-14-2-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.14.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Seriously Simple Podcasting", "source": "cna", "vendor": "Craig Hewitt"}, "product": "seriously_simple_podcasting", "vendor": "craig_hewitt"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-10T19:39:05.754387+00:00", "value": {"mitigation_remediation": ["Upgrade the Seriously\u202fSimple\u202fPodcasting plugin to the latest version (3.15 or newer).", "Verify that the plugin is no longer listed as vulnerable in your CMS security scans. ", "If an immediate upgrade cannot be performed, restrict access to the plugin\u2019s administrative pages to users with the \"Administrator\" role or remove the plugin entirely. ", "Monitor the website\u2019s access logs for anomalous activity targeting podcast management endpoints. ", "Keep the WordPress core and all plugins regularly updated."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access and Data Tampering"}, "threat_synthesis": {"affected_systems": "The flaw exists in the Seriously\u202fSimple\u202fPodcasting WordPress plugin from all versions that have not yet been upgraded past 3.14.2. Any WordPress installation that still hosts a vulnerable version of this plugin is potentially affected, regardless of the site\u2019s overall configuration.", "description_and_impact": "This vulnerability arises from a missing authorization check in Craig Hewitt\u2019s Seriously\u202fSimple\u202fPodcasting plugin. Because access controls are incorrectly configured, an attacker can reach privileged functions\u2014such as creating, editing, or deleting podcasts, and viewing private media\u2014without being authenticated. The flaw is a classic broken access control scenario, classified as CWE\u2011862. Successful exploitation could allow an attacker to read, modify, or erase podcast content and administrative settings, jeopardizing confidentiality, integrity, and availability of the site\u2019s media assets.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates medium severity, and the EPSS score of less than 1\u202f% suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread attacks. Based on the description, the attack vector is likely web\u2011based, leveraging HTTP requests to the plugin\u2019s endpoints that lack proper authorization. Although the flaw could be abused remotely via the public web interface, no evidence currently points to widespread exploitation, and the overall risk remains moderate."}}}}, "created": "2026-04-08T19:30:35.860660+00:00", "updated": "2026-04-13T14:25:31.175872+00:00", "vendors": ["craig_hewitt", "craig_hewitt$PRODUCT$seriously_simple_podcasting", "wordpress", "wordpress$PRODUCT$wordpress"]}