CVE-2026-1219

Name of the Vulnerable Software and Affected Versions MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar versions 4.0 through 5.10

Description The MP3 Audio Player plugin for WordPress has an issue related to Insecure Direct Object Reference. This occurs due to a lack of validation on a user-controlled key within the load track note ajax function. This allows unauthenticated attackers to view the contents of private posts.

Recommendations Update the MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin to a version newer than 5.10.