CVE-2026-8679

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-8679

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8679.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-8679

Published

2026-05-22T07:50:27Z

Modified

2026-08-12T03:51:14Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter

Details

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.

Database specific

{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8679.json"
}

References

Affected packages

Git / github.com/cssigniter/audioigniter

Affected ranges

Type

GIT

Repo

https://github.com/cssigniter/audioigniter

Events

Introduced

Fixed

35a0508583c26c01b6ac446404ad6fe1d440d8d4

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.1.0

1.2.0

1.3.0

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

1.6.3

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0

1.9.0

2.*

2.0.0

2.0.1

2.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8679.json"