CVE-2026-8679: CWE-639 Authorization Bypass Through User-Controlled Key in cssigniterteam AudioIgniter Music Player
The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.
AI Analysis
Technical Summary
CVE-2026-8679 is an Insecure Direct Object Reference vulnerability in the AudioIgniter Music Player WordPress plugin (up to version 2.0.2). The handle_playlist_endpoint() function, triggered on template_redirect, accepts a playlist ID from user input via query variables or rewrite rules and returns playlist track data without performing authentication or authorization checks. Only the post_type is validated, allowing unauthenticated users to access sensitive playlist metadata for any playlist on the site, including those not publicly visible.
Potential Impact
An unauthenticated attacker can retrieve sensitive playlist metadata such as track titles, artists, audio URLs, buy links, download URLs, and cover images from any playlist on the affected WordPress site. This exposure includes playlists in draft, private, pending, or trash status, potentially leading to unauthorized disclosure of content that site owners intended to keep restricted. There is no impact on integrity or availability reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the affected endpoints via web application firewall rules or other access controls to prevent unauthenticated access. Monitor vendor channels for updates and apply official patches once released.
CVE-2026-8679: CWE-639 Authorization Bypass Through User-Controlled Key in cssigniterteam AudioIgniter Music Player
Description
The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-8679 is an Insecure Direct Object Reference vulnerability in the AudioIgniter Music Player WordPress plugin (up to version 2.0.2). The handle_playlist_endpoint() function, triggered on template_redirect, accepts a playlist ID from user input via query variables or rewrite rules and returns playlist track data without performing authentication or authorization checks. Only the post_type is validated, allowing unauthenticated users to access sensitive playlist metadata for any playlist on the site, including those not publicly visible.
Potential Impact
An unauthenticated attacker can retrieve sensitive playlist metadata such as track titles, artists, audio URLs, buy links, download URLs, and cover images from any playlist on the affected WordPress site. This exposure includes playlists in draft, private, pending, or trash status, potentially leading to unauthorized disclosure of content that site owners intended to keep restricted. There is no impact on integrity or availability reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the affected endpoints via web application firewall rules or other access controls to prevent unauthenticated access. Monitor vendor channels for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-15T13:31:39.001Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a10177ee1370fbb48d0f0a8
Added to database: 5/22/2026, 8:44:46 AM
Last enriched: 5/22/2026, 8:59:50 AM
Last updated: 5/22/2026, 3:22:35 PM
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.