CVE-2026-13729
Last modified
CVE-2026-13729 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.. EPSS estimates a 0.10% chance of exploitation in the next 30 days.
Description
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Podlove Podcast Publisher | < 4.5.3 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-13729?
How severe is CVE-2026-13729?
How do I fix CVE-2026-13729?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-13722WatchGuard Fireware OS contains a firmware validation bypass…8.6
- CVE-2026-13723A vulnerability in the `zipx.Unzip` extraction routine of De…6.5
- CVE-2026-13724Client-Side Enforcement of Server-Side Security vulnerabilit…4.3
- CVE-2026-13725The Dynamic Pricing With Discount Rules for WooCommerce Word…7.1
- CVE-2026-13726The MPG WordPress plugin before 4.1.8 does not sanitise and…7.1
- CVE-2026-13728In exception circumstances, WatchGuard Fireware OS on a Fire…4.4
- CVE-2026-1373The Easy Author Image plugin for WordPress is vulnerable to …6.4
- CVE-2026-13731The WPBot – AI ChatBot for Live Support, Lead Generation, AI…7.2
- CVE-2026-13733The Download Manager plugin for WordPress is vulnerable to S…6.4
- CVE-2026-13737CommServe contained an allowlist bypass vulnerability affect…9.2
- CVE-2026-13738CommServe contained an authorization bypass vulnerability af…9.2
- CVE-2026-13739A legacy endpoint in Command Center contained an unauthentic…8.8
Are you affected by CVE-2026-13729?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST