CVE

CVE-2026-8679

7.5

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

audioigniter music player

Updated Nov 10, 2026View on NVD →

S4E scanner

highMisconfiguration~10 seconds

WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication. References: https://plugins.trac.wordpress.org/browser/audioigniter/trunk/audioigniter.php https://nvd.nist.gov/vuln/detail/CVE-2026-8679 https://wordpress.org/plugins/audioigniter/ Remediation: Update to the latest version of AudioIgniter plugin.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: audioigniter music player

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →