Authorization bypass in sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sonaar | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | 4.0 – 5.10 | — | No fix listed | CNA |
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Vendorsonaar Affected 4.0 – 5.10 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sonaar:mp3_audio_player_for_music\,_radio_\&_podcast:*:*:*:*:*:*:*:* | — | — | sonaar |
- cpe:2.3:a:sonaar:mp3_audio_player_for_music\,_radio_\&_podcast:*:*:*:*:*:*:*:* Versions — — ·sonaar
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1219
- 2026-10-03 Alias added: GHSA-c977-4m9f-fcfc
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8fa964-d543-4d46-a534-e403dff4f425?source=cve
- https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.10/sonaar-music.php#L179
- https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.10/public/class-sonaar-music-public.php#L323
- https://plugins.trac.wordpress.org/changeset/3453076/
More sonaar vulnerabilities
- TI-2023-30625 WordPress Sonaar Music Plugin 4.7 Stored XSS via Comments CVSS 4.0MEDIUM 5.1
- TI-2024-07281 Missing authorization in sonaar MP3 Audio Player – Music Player, Podcast Player & Radio… CVSS 3.1HIGH 8.1
- TI-2025-37093 WordPress Sonaar theme <= 4.27.4 - Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
- TI-2024-20715 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10.1 - Arbitrary File Download vulnerability CVSS 3.1HIGH 7.5
- TI-2024-37236 WordPress MP3 Audio Player plugin <= 5.8 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2023-25930 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2026-1219 · CVE Program
- CVE-2026-1219 · NVD
- FIRST EPSS
- GHSA-c977-4m9f-fcfc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences