PT-2026-42737 · WordPress · Audioigniter

Nudien Udin · CVE-2026-8679 · Published 2026-05-22 · Updated 2026-05-22

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AudioIgniter versions prior to 2.0.3

Description The AudioIgniter plugin for WordPress contains an Insecure Direct Object Reference (IDOR) issue. This occurs because the handle playlist endpoint() function (hooked to template redirect) accepts a user-controlled playlist ID through the audioigniter playlist id query variable or the '/audioigniter/playlist/{id}/' endpoint and returns track data without verifying authentication, capabilities, or post status, validating only the post type. This allows unauthenticated attackers to access track metadata, including titles, artists, audio URLs, purchase links, download URLs, and cover images, for any playlist, including those marked as draft, private, pending, or trash.

Recommendations Update to a version later than 2.0.2.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-8679

Affected Products

Audioigniter

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8679.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8679 · Security Note
• https://osv.dev/vulnerability/CVE-2026-8679 · Vendor Advisory
• https://github.com/cssigniter/audioigniter/commit/35a0508583c26c01b6ac446404ad6fe1d440d8d4 · Note
• https://t.me/CVEtracker/54614 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fe573d64-036e-4f6f-bcc1-5183bb9ad2b9?source=cve · Note
• https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php#L1315 · Note
• https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php#L1257 · Note
• https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php#L1263 · Note
• https://twitter.com/CVEnew/status/2057783163502387542 · Twitter Post