CVE-2026-8679
Insecure Direct Object Reference in AudioIgniter WordPress Plugin
Publication date: 2026-05-22
Last updated on: 2026-05-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cssigniter | audioigniter | to 2.0.2 (inc) |
| cssigniter | audioigniter | to 2.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The AudioIgniter plugin for WordPress, in versions up to and including 2.0.2, has a vulnerability known as Insecure Direct Object Reference. This occurs because the handle_playlist_endpoint() function accepts a user-controlled playlist ID without proper authentication or permission checks. As a result, unauthenticated attackers can access playlist track data such as titles, artists, audio URLs, buy links, download URLs, and cover images, even for playlists that are draft, private, pending, or trashed.
How can this vulnerability impact me? :
This vulnerability allows unauthorized users to view sensitive playlist metadata that should be restricted. Attackers can access unpublished or private playlist information without any authentication, potentially exposing confidential or proprietary content. This can lead to privacy breaches and unauthorized disclosure of data hosted on the affected WordPress site.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the AudioIgniter plugin version is 2.0.2 or earlier, as these versions lack proper authentication and authorization checks on the playlist endpoint.
To detect exploitation attempts on your system or network, you can monitor HTTP requests targeting the playlist JSON endpoint, specifically requests containing the query variable 'audioigniter_playlist_id' or URLs matching the pattern '/audioigniter/playlist/{id}/'.
Example command to search web server logs for suspicious access to the playlist endpoint:
- grep -E 'audioigniter_playlist_id=|/audioigniter/playlist/' /var/log/apache2/access.log
You can also use curl to manually test if the endpoint returns playlist data without authentication:
- curl -s 'https://yourwordpresssite.com/?audioigniter_playlist_id=1'
- curl -s 'https://yourwordpresssite.com/audioigniter/playlist/1/'
If these commands return playlist metadata without requiring authentication, your site is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended step to mitigate this vulnerability is to update the AudioIgniter plugin to version 2.0.3 or later, where the issue has been fixed by adding proper authentication and playlist status checks.
If updating immediately is not possible, consider temporarily restricting access to the playlist endpoint by implementing web server rules or firewall rules that block unauthenticated requests to URLs containing '/audioigniter/playlist/' or the query parameter 'audioigniter_playlist_id'.
Additionally, review and tighten WordPress user permissions and consider disabling or limiting the plugin functionality until the update can be applied.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to access playlist track metadata, including titles, artists, audio URLs, buy links, download URLs, and cover images, even for playlists in draft, private, pending, or trash status.
This unauthorized exposure of potentially sensitive or unpublished data could lead to non-compliance with data protection regulations such as GDPR or HIPAA, which require proper access controls and protection of personal or sensitive information.
However, the provided context does not explicitly mention compliance impacts or regulatory considerations.