CVE-2026-1249

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1249", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-20T18:58:08.045Z", "datePublished": "2026-02-14T08:26:46.021Z", "dateUpdated": "2026-02-17T15:44:52.991Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-14T08:26:46.021Z"}, "affected": [{"vendor": "sonaar", "product": "MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar", "versions": [{"version": "5.3", "status": "affected", "lessThanOrEqual": "5.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/261aad1e-43fc-4927-a97d-85a001863023?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3453076/mp3-music-player-by-sonaar/trunk/sonaar-music.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Dunn"}], "timeline": [{"time": "2026-01-08T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-13T20:09:32.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T15:36:27.482548Z", "id": "CVE-2026-1249", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:44:52.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1249", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:36:27.482548Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:36:28.170Z"}}], "cna": {"title": "MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Dunn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "sonaar", "product": "MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar", "versions": [{"status": "affected", "version": "5.3", "versionType": "semver", "lessThanOrEqual": "5.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-08T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-13T20:09:32.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/261aad1e-43fc-4927-a97d-85a001863023?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3453076/mp3-music-player-by-sonaar/trunk/sonaar-music.php"}], "descriptions": [{"lang": "en", "value": "The MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-14T08:26:46.021Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1249", "state": "PUBLISHED", "dateUpdated": "2026-02-17T15:44:52.991Z", "dateReserved": "2026-01-20T18:58:08.045Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T08:26:46.021Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar", "vendor": "sonaar", "versions": [{"lessThanOrEqual": "5.10", "status": "affected", "version": "5.3", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin MP3 Audio Player \u2013 Music Player, Podcast Player & Radio de Sonaar para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en las versiones 5.3 a la 5.10 a trav\u00e9s de la funci\u00f3n 'load_lyrics_ajax_callback'. Esto permite a atacantes autenticados, con acceso de nivel de autor y superior, realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2026-1249", "lastModified": "2026-06-17T10:15:23.737", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1249", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T15:36:27.482548Z", "version": "2.0.3"}}]}, "published": "2026-02-14T09:16:11.850", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3453076/mp3-music-player-by-sonaar/trunk/sonaar-music.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/261aad1e-43fc-4927-a97d-85a001863023?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.3,5.10]"}}], "product": "mp3_audio_player_\u2013_music_player,_podcast_player_&_radio_by_sonaar", "vendor": "sonaar"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-18T12:29:00.699443+00:00", "value": {"mitigation_remediation": ["Update the Sonaar MP3 Audio Player plugin to the latest available release of the plugin.", "If an upgrade cannot be performed immediately, remove author\u2011level users from being able to trigger the load_lyrics_ajax_callback endpoint by revoking or restricting the 'edit_others_posts' capability or disabling the feature through plugin settings.", "Configure the application or network firewall to block outbound HTTP/HTTPS traffic from the WordPress host to internal IP ranges, limiting the server\u2019s reach to only necessary external destinations."], "summary": {"action": "Assess", "impact": "Server\u2011Side Request Forgery (SSRF) allowing internal network requests by author\u2011level users"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Sonaar MP3 Audio Player \u2013 Music Player, Podcast Player & Radio plugin for WordPress in versions 5.3 through 5.10.", "description_and_impact": "A Server\u2011Side Request Forgery exists in the MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar. The flaw resides in the load_lyrics_ajax_callback function and permits authenticated attackers with author or higher privileges to instruct the WordPress server to perform web requests to arbitrary URLs. This can be used to exfiltrate data, read sensitive internal endpoints, or alter configuration on those services, thereby undermining data confidentiality and integrity.", "risk_and_exploitability": "The CVSS score of 5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, but it can be exploited by any user with author level access who can invoke the AJAX call. Because the request originates from the web application, it can target internal services that are otherwise inaccessible to external attackers, creating a significant insider\u2011risk scenario."}}}}, "created": "2026-02-16T12:01:58.149136+00:00", "updated": "2026-04-18T12:30:45.480955+00:00", "vendors": ["sonaar", "sonaar$PRODUCT$mp3_audio_player_\u2013_music_player,_podcast_player_&_radio_by_sonaar", "wordpress", "wordpress$PRODUCT$wordpress"]}