What’s Vulnerable › Vulnerabilities

CVE-2024-1110: Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-07 · updated 2026-06-17
• Weakness: CWE-862

Description

The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.

Affected products

• Podlove Podcast Publisher: through 4.0.11

References

• https://github.com/podlove/podlove-publisher/commit/7873ff520631087e2f10737860cdcd64d53187ba
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032008%40podlove-podcasting-plugin-for-wordpress&new=3032008%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9cf461-572c-4be8-96e6-659acf3208f3?source=cve
• https://github.com/podlove/podlove-publisher/commit/7873ff520631087e2f10737860cdcd64d53187ba
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032008%40podlove-podcasting-plugin-for-wordpress&new=3032008%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9cf461-572c-4be8-96e6-659acf3208f3?source=cve

Get alerted when CVE-2024-1110 or the next vulnerability affects your stack