CVE-2024-7856 is a critical missing authorization vulnerability (CWE-862) in the Sonaar MP3 Audio Player – Music Player, Podcast Player & Radio WordPress plugin. The vulnerability stems from a lack of proper capability checks in the removeTempFiles() function combined with insufficient validation of the 'file' parameter. This allows authenticated users with minimal privileges (subscriber-level or higher) to delete arbitrary files on the web server. Since WordPress relies heavily on the integrity of configuration files like wp-config.php, deleting such files can disrupt site functionality and enable attackers to execute remote code by forcing WordPress into insecure states or triggering fallback behaviors. The vulnerability affects all versions up to 5.7.0.1 and has a CVSS 3.1 base score of 9.1, reflecting its critical severity. The attack vector is network-based with no user interaction needed, and the attack complexity is low, making exploitation straightforward once an attacker has subscriber-level access. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to WordPress sites using this plugin, especially those with multiple user roles. The absence of patches at the time of disclosure increases the urgency for administrators to apply workarounds or restrict access until a fix is available.

The impact of CVE-2024-7856 is severe for organizations using the Sonaar MP3 Audio Player plugin on WordPress sites. Unauthorized arbitrary file deletion can lead to denial of service by removing critical files, data loss, and potential remote code execution if attackers delete configuration files like wp-config.php. This can result in full site compromise, data breaches, defacement, or use of the site as a pivot point for further attacks. Since subscriber-level users can exploit this, even low-privileged accounts pose a threat, increasing the attack surface. Organizations with multi-user WordPress environments, especially those allowing subscriber or contributor roles, are at higher risk. The vulnerability can disrupt business operations, damage reputation, and incur remediation costs. Given WordPress's widespread use globally, the threat affects a broad range of industries, including media, e-commerce, and content providers relying on this plugin for audio content delivery.

Until an official patch is released, organizations should implement the following mitigations: 1) Restrict subscriber-level user capabilities by disabling or limiting plugin access to trusted users only; 2) Employ Web Application Firewalls (WAFs) with custom rules to detect and block suspicious requests targeting the removeTempFiles() function or containing file deletion parameters; 3) Monitor file system integrity and set up alerts for unexpected deletions, especially of critical files like wp-config.php; 4) Limit file system permissions to prevent the web server user from deleting sensitive files; 5) Regularly back up WordPress files and databases to enable quick restoration if deletion occurs; 6) Review and audit user roles and permissions to minimize unnecessary subscriber accounts; 7) Follow Sonaar plugin updates closely and apply patches immediately once available; 8) Consider temporarily disabling or replacing the vulnerable plugin if feasible to eliminate exposure.