{"id":"CVE-2026-1219","aliases":["EUVD-2026-7798","GHSA-c977-4m9f-fcfc"],"status":"published","title":"MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure","description":"The MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00285,"percentile":0.21189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-02-19T09:26:36Z","modified":"2026-06-17T10:15:20Z","products":[{"vendor":"sonaar","product":"mp3 audio player – music player, podcast player \u0026 radio by sonaar"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8fa964-d543-4d46-a534-e403dff4f425?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.10/sonaar-music.php#L179"},{"url":"https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.10/public/class-sonaar-music-public.php#L323"},{"url":"https://plugins.trac.wordpress.org/changeset/3453076/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1219"},{"url":"https://plugins.trac.wordpress.org/changeset/3453076"},{"url":"https://github.com/advisories/GHSA-c977-4m9f-fcfc"}],"sources":{"cve":[{"id":"CVE-2026-1219","title":"MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure","description":"The MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.","status":"published","published":"2026-02-19T09:26:36.53Z","modified":"2026-02-20T20:37:50.944Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:20:00.879257Z"}],"euvd":[{"id":"EUVD-2026-7798","description":"The MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.","status":"published","published":"2026-02-19T09:26:36Z","modified":"2026-02-20T20:37:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:36.125178Z"}],"ghsa":[{"id":"GHSA-c977-4m9f-fcfc","title":"The MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar plugin for WordPress is...","description":"The MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.","status":"published","published":"2026-02-19T18:31:54Z","modified":"2026-02-19T18:32:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:06:16.865747Z"}],"nvd":[{"id":"CVE-2026-1219","description":"The MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.","status":"published","published":"2026-02-19T10:16:11.277Z","modified":"2026-06-17T10:15:20.66Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:06.274729Z"}]}}