CVE-2024-43984

The attacker prepares a malicious website or crafted link containing an HTTP request that performs a dangerous operation on behalf of a logged-in user of the plugin. The plugin does not sufficiently verify whether the request originates from a trusted source (missing or bypassed CSRF token). After tricking the victim — for example, a WordPress administrator — into visiting the malicious site, the request is executed in their context, leading to code injection and arbitrary code execution on the server side.

An attacker can gain full control over the server hosting the WordPress site, including reading, modifying, or deleting data and installing malicious software. The vulnerability enables a breach of confidentiality, integrity, and availability of the system to the highest degree.

The Podlove Podcast Publisher plugin should be immediately updated to a version higher than 4.1.13. Detailed information about available patches can be found in the vendor's references and in the Patchstack database.

Podlove Podcast Publisher in versions from the beginning of the project through 4.1.13 inclusive (from n/a through 4.1.13).