CVE-2026-8679

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-8679

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8679.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-8679

Published

2026-05-22T07:50:27.202Z

Modified

2026-07-15T01:49:22.250848660Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter

Details

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handleplaylistendpoint() function (hooked to templateredirect) accepting a user-controlled playlist ID via the audioigniterplaylistid query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or poststatus check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.

Database specific

{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8679.json",
    "cna_assigner": "Wordfence"
}

References

Affected packages

Git / github.com/cssigniter/audioigniter

Affected ranges

Type

GIT

Repo

https://github.com/cssigniter/audioigniter

Events

Introduced

Fixed

35a0508583c26c01b6ac446404ad6fe1d440d8d4

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.1.0

1.2.0

1.3.0

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

1.6.3

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0

1.9.0

2.*

2.0.0

2.0.1

2.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8679.json"