CVE-2024-7856 is a missing authorization vulnerability (CWE-862) in the Sonaar MP3 Audio Player – Music Player, Podcast Player & Radio WordPress plugin. The removeTempFiles() function lacks proper capability checks and does not sufficiently validate the 'file' parameter path, enabling authenticated users with subscriber-level privileges or higher to delete arbitrary files. This can lead to severe consequences such as remote code execution if key files like wp-config.php are removed. The vulnerability affects all versions up to and including 5.7.0.1 and has a CVSS 3.1 score of 8.1, indicating high severity.

Authenticated attackers with subscriber-level access or above can delete arbitrary files on the affected WordPress server. This unauthorized file deletion can disrupt service availability and potentially enable remote code execution if critical configuration files are deleted. The impact includes high integrity and availability loss but no direct confidentiality impact is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious file deletions. Avoid granting unnecessary plugin access to low-privilege users.