PatchSiren cyber security CVE debrief
CVE-2026-8679 cssigniterteam CVE debrief
The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. Unauthenticated attackers can view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.
- Vendor
- cssigniterteam
- Product
- AudioIgniter Music Player
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-22
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-05-22
- Advisory updated
- 2026-07-23
Who should care
Unauthenticated attackers can view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status. This vulnerability allows attackers to access sensitive playlist data without authentication, making it a high-priority concern for site administrators and security teams.
Technical summary
The handle_playlist_endpoint() function in the AudioIgniter plugin for WordPress accepts a user-controlled playlist ID and returns playlist track data without authentication, capability, or post_status checks. Only the post_type is validated, allowing unauthenticated access to track metadata. This vulnerability allows unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.
Defensive priority
High priority due to the high CVSS score of 7.5 and the potential for unauthorized access to sensitive playlist data.
Recommended defensive actions
- Update the AudioIgniter plugin to a version that fixes the Insecure Direct Object Reference vulnerability.
- Restrict access to playlist data using WordPress access controls and authentication mechanisms.
- Monitor for suspicious activity related to playlist access.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Evidence notes
The CVE record was published on 2026-05-22T09:16:32.887Z and was last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This vulnerability allows unauthenticated attackers to view track metadata of any playlist on the site. The handle_playlist_endpoint() function in the AudioIgniter plugin for WordPress accepts a user-controlled playlist ID and returns playlist track data without authentication, capability, or post_status checks. Only the post_type is validated, allowing unauthenticated access to track metadata.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-22T09:16:32.887Z and has not been modified since then. The NVD entry is currently Deferred.