{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39505", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:47:50.136Z", "datePublished": "2026-04-08T08:30:13.629Z", "dateUpdated": "2026-04-08T08:30:13.629Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "seriously-simple-podcasting", "product": "Seriously Simple Podcasting", "vendor": "Craig Hewitt", "versions": [{"changes": [{"at": "3.14.3", "status": "unaffected"}], "lessThanOrEqual": "3.14.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "hivesec | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:29:01.705Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.</p>"}], "value": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:13.629Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-14-2-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2."}], "id": "CVE-2026-39505", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:24.647", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-14-2-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.14.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Seriously Simple Podcasting", "source": "cna", "vendor": "Craig Hewitt"}, "product": "seriously_simple_podcasting", "vendor": "craig_hewitt"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T10:16:42.801380+00:00", "value": {"mitigation_remediation": ["Update Seriously Simple Podcasting to version 3.14.3 or later.", "Verify that new updates enforce proper access restrictions.", "If an immediate update cannot be applied, disable the plugin or restrict its publicly accessible URLs until a patch is available."], "summary": {"action": "Patch Update", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "This issue affects the Seriously Simple Podcasting plugin developed by Craig Hewitt. Any installation of the plugin with a version number up to and including 3.14.2 is vulnerable. WordPress sites that use this plugin for podcasting are at risk if they have not applied a later patch.", "description_and_impact": "The vulnerability is a missing authorization flaw in the Seriously Simple Podcasting plugin. It allows an attacker to bypass intended access controls on WordPress sites that host the plugin, potentially enabling the reading, creation, modification, or deletion of podcast media and related data. By exploiting incorrectly configured access control security levels, an attacker could gain access to content normally restricted to authenticated users, leading to unauthorized disclosure or alteration of proprietary audio assets. The weakness is categorized as CWE\u2011862, an access control violation.", "risk_and_exploitability": "The CVSS score is not provided, and EPSS data is unavailable, so the risk assessment relies on the inherent severity of a broken access control flaw. The attack vector is inferred to be through accessible plugin URLs or API endpoints, meaning that an attacker who can reach the WordPress site can identify and exploit the vulnerability without additional privileges. The vulnerability is not listed in the CISA KEV catalog, so no widely known exploitation is documented, but the potential impact remains significant if the plugin remains outdated."}}}}, "created": "2026-04-08T19:30:35.860660+00:00", "updated": "2026-04-08T19:43:02.739708+00:00", "vendors": ["craig_hewitt", "craig_hewitt$PRODUCT$seriously_simple_podcasting", "wordpress", "wordpress$PRODUCT$wordpress"]}