WordPress Plugin Vulnerabilities
MP3 Audio Player for Music, Radio & Podcast by Sonaar < 5.0 - Unauthenticated Arbitrary File Download
Description
The MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin for WordPress is vulnerable to arbitrary file downloads due to insufficient file validation on the load_lyrics_ajax_callback() function in all versions up to, and including, 4.10.1. This makes it possible for unauthenticated attackers to download arbitrary files such as wp-config.php.
Affects Plugins
Fixed in 5.0 References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
beluga
Verified
No
WPVDB ID
Timeline
Publicly Published
2024-04-05 (about 2 years ago)
Added
2024-04-10 (about 2 years ago)
Last Updated
2024-04-10 (about 2 years ago)
WPScan 