CVE-2026-1219

🗓️ 19 Feb 2026 09:26:36Reported by AttackerKBType

CVE-2026-1219: Sonaar MP3 Player plugin allows unauthenticated access to private posts via insecure direct object reference on load_track_note_ajax.

Reporter	Title	Published	Views	Family All 9
CNNVD	WordPress plugin MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 安全漏洞	19 Feb 202600:00	–	cnnvd
CVE	CVE-2026-1219	19 Feb 202609:26	–	cve
Cvelist	CVE-2026-1219 MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure	19 Feb 202609:26	–	cvelist
NVD	CVE-2026-1219	19 Feb 202610:16	–	nvd
Patchstack	WordPress MP3 Audio Player 4.0-5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure vulnerability	19 Feb 202600:18	–	patchstack
Positive Technologies	PT-2026-20776	19 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-1219	20 Feb 202613:25	–	redhatcve
Vulnrichment	CVE-2026-1219 MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure	19 Feb 202609:26	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (February 16, 2026 to February 22, 2026)	26 Feb 202616:02	–	wordfence

Vulners

Node

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.10/sonaar-music.php
plugins	www.plugins.trac.wordpress.org/changeset/3453076/
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
plugins	www.plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.10/public/class-sonaar-music-public.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ce8fa964-d543-4d46-a534-e403dff4f425

19 Feb 2026 10:30Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.3

EPSS0.00245