Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure

Description The plugin discloses the Podcast owner’s email address (which by default is the admin email address) via an unauthenticated crafted request. This was fixed in 3.0.0 for new plugin installation, however when upgrading, users will have to unset the “Owner email address” in the Feed Details settings

PoC

View the source of the page below and notice the email being disclosed: https://example.com/?feed=itunes https://example.com/feed/podcast/