Read the docs
TI-2016-00713 Aliases CVE-2016-0796GHSA-mgq5-593j-jv2x

Improper authentication in WordPress Plugin mb.miniAudioPlayer-an

Priority LOW 36CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind vulnerable website or to perform otherwise restricted actions and subsequently download files with the extension mp3, mp4a, wav and ogg from anywhere the web server application has read access to the system. WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 is vulnerable; prior versions may also be affected.

Why it matters now

EPSS 0.01331 71st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—WordPress Plugin mb.miniAudioPlayer-anversion 1.7.6—No fix listedCNA
  • WordPress Plugin mb.miniAudioPlayer-an Vendor— Affected version 1.7.6 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mb.miniaudioplayer_project:mb.miniaudioplayer:*:*:*:*:*:wordpress:*:*up to 1.7.6VulnerableMb.miniaudioplayer Project
  • cpe:2.3:a:mb.miniaudioplayer_project:mb.miniaudioplayer:*:*:*:*:*:wordpress:*:* Versions up to 1.7.6 Vulnerable ·Mb.miniaudioplayer Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-0796
  2. 2026-10-03 Alias added: GHSA-mgq5-593j-jv2x

References

Exploit 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences