CVE-2023-6444 Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure
Unauthenticated attackers can disclose the podcast owner's email address, which defaults to the admin email, via a crafted request.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6444?
CVE-2023-6444 is a medium-severity vulnerability in Unknown Seriously Simple Podcasting, published on 11 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.
Which versions are affected by CVE-2023-6444?
It affects 1 product.
Products include Castos Seriously Simple Podcasting.
How do I fix CVE-2023-6444?
No fix has been published for CVE-2023-6444 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-6444 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6444 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Unknown Seriously Simple Podcasting
- CVE-2024-25599 WordPress Seriously Simple Podcasting plugin <= 3.0.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-9667 Seriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg Parameter
- CVE-2025-49923 WordPress Seriously Simple Podcasting plugin <= 3.11.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-46261 WordPress Seriously Simple Podcasting plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2022-4571 Seriously Simple Podcasting < 2.19.1 - Contributor+ Stored XSS
Sources
Also known as GHSA-qhfg-qx72-6jw4.