What is CVE-2026-13729?

CVE-2026-13729 is a medium-severity vulnerability in Podlove Podcast Publisher, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2026-08-01.

How severe is CVE-2026-13729?

Medium severity. CVSS v3 base score is 4.3 out of 10.

CSRF in Podlove Podcast Publisher

CVE-2026-13729

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.001 (0.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Unknown Podlove Podcast Publisher — versions 0

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-13729?: CVE-2026-13729 is a medium-severity vulnerability in Podlove Podcast Publisher, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2026-08-01.
How severe is CVE-2026-13729?: Medium severity. CVSS v3 base score is 4.3 out of 10.