The mra13 Compact WP Audio Player plugin for WordPress contains an SSRF vulnerability (CVE-2024-56279) in versions up to 1.9.14. This vulnerability enables an attacker with low privileges to cause the server to perform HTTP requests to arbitrary locations, potentially leading to information disclosure or integrity issues. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impacts. No patch or official remediation guidance has been provided in the available data.

Successful exploitation could allow an attacker with low privileges to make the server send crafted requests to internal or external systems, potentially exposing sensitive information or manipulating data accessible to the server. There is no indication of availability impact or known active exploitation. The medium severity rating reflects these partial confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin features to trusted users only and monitor for unusual server-side request activity related to the plugin. Avoid exposing the plugin to untrusted users or inputs that could trigger SSRF.