Research Plan: CVE-2026-39505 - Unauthorized Action in Seriously Simple Podcasting

1. Vulnerability Summary

The Seriously Simple Podcasting plugin (versions <= 3.14.2) contains a missing authorization vulnerability in an AJAX handler. Specifically, the action update_episode_embed_code fails to implement a capability check (e.g., current_user_can()) and does not verify a WordPress nonce. This allows unauthenticated attackers to perform an unauthorized action—specifically, modifying the embed code dimensions (width and height) for any podcast episode, which can disrupt the site's layout or potentially disclose information if applied to private posts.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: update_episode_embed_code
• HTTP Method: POST
• Parameters:
  • action: update_episode_embed_code (Required)
  • post_id: The ID of the podcast episode to modify.
  • width: The desired width for the embed code.
  • height: The desired height for the embed code.
• Authentication: None required (the action is likely registered via wp_ajax_nopriv_update_episode_embed_code or the wp_ajax_ handler lacks a login check and is reachable).
• Preconditions: The attacker needs to know or guess the post_id of a podcast episode.

3. Code Flow

1. Frontend (JS): In assets/js/admin.js (and admin.min.js), the plugin listens for changes on elements with the class .episode_embed_code_size_option.
2. AJAX Trigger: When a change occurs, the following jQuery code (verbatim from assets/js/admin.js) is executed:

   $( '.episode_embed_code_size_option' ).on('change', function() {
       var width = $( '#episode_embed_code_width' ).val();
       var height = $( '#episode_embed_code_height' ).val();
       var post_id = $( '#post_ID' ).val();
   
       $.post(
           ajaxurl,
           {
               action: 'update_episode_embed_code',
               width: width,
               height: height,
               post_id: post_id
           },
           function(response) {
               if( response ) {
                   $( '#episode_embed_code' ).val( response );
                   $( '#episode_embed_code' ).select();
               }
           }
       );
   });
   

3. Backend (PHP): The request is received by admin-ajax.php. It routes to the update_episode_embed_code callback (likely in an AJAX controller or the main plugin class).
4. Processing: The handler reads post_id, width, and height. It fails to call current_user_can( 'edit_post', $post_id ) or check_ajax_referer(). It likely updates the post meta and returns the newly generated HTML embed code.

4. Nonce Acquisition Strategy

According to the source code in `assets/js/admin.js