CVEvulnerability

CVE-2026-1249

5.0 MEDIUM Published 2026-02-14 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2026-02-14
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 5.0 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weaknesses: CWE-918

Description

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Weakness · CWE (1)

CWE-918 Server-Side Request Forgery weakness

References

https://plugins.trac.wordpress.org/changeset/3453076/mp3-music-player-by-sonaar/trunk/sonaar-music.php plugins.trac.wordpress.org
https://www.wordfence.com/threat-intel/vulnerabilities/id/261aad1e-43fc-4927-a97d-85a001863023?source=cve www.wordfence.com

CVE-2026-1249

Description

Related

Weakness · CWE (1)

References