WordPress Plugin Vulnerabilities

MP3 Audio Player for Music, Radio & Podcast by Sonaar < 5.12 - Unauthenticated Server-Side Request Forgery

Description

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.11. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
mp3-music-player-by-sonaar
Fixed in 5.12

References

CVE
CVE-2026-39647
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/cb713c9c-adb4-410c-a92f-d4d5b002d626

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
johska
Verified
No
WPVDB ID
cd5aeddc-23cc-40ea-83da-2a066ecabb01

Timeline

Publicly Published
2026-02-15 (about 4 months ago)
Added
2026-05-05 (about 1 month ago)
Last Updated
2026-05-11 (about 1 month ago)

Other

Published
Title
Published
2024-11-01
Title
Magical Addons For Elementor < 1.2.3 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2023-09-05
Title
Starter Templates <= 3.2.4 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2025-03-19
Title
Order Export & Order Import for WooCommerce < 2.6.1 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
Published
2026-01-23
Title
Radio Player <= 2.0.91 - Unauthenticated Server-Side Request Forgery
Published
2016-04-12
Title
WordPress <= 4.4.2 - SSRF Bypass using Octal & Hexedecimal IP addresses