CVE-2024-7856

🗓️ 29 Aug 2024 03:52:57Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 73 Views🌐 WEB

MP3 Audio Player plugin for WordPress <= 5.7.0.1 Vulnerabilit

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for Missing Authorization in Sonaar Mp3_Audio_Player_For_Music\,_Radio_\&_Podcast	9 Sep 202408:34	–	githubexploit
Circl	CVE-2024-7856	29 Aug 202413:42	–	circl
CNNVD	WordPress plugin MP3 Audio Player 安全漏洞	29 Aug 202400:00	–	cnnvd
Cvelist	CVE-2024-7856 MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion	29 Aug 202403:52	–	cvelist
NVD	CVE-2024-7856	29 Aug 202411:15	–	nvd
OSV	CVE-2024-7856	29 Aug 202411:15	–	osv
Patchstack	WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin <= 5.7.0.1 is vulnerable to Arbitrary File Deletion	29 Aug 202400:00	–	patchstack
Patchstack	WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion vulnerability	29 Aug 202401:03	–	patchstack
Positive Technologies	PT-2024-38633 · Sonaar · Mp3 Audio Player – Music Player	28 Aug 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-7856	5 Feb 202511:40	–	redhatcve

NVD

Vulners

Vulnrichment

Node

sonaar mp3_audio_player_for_music,_radio_&_podcastRange<5.7.1wordpress

[
  {
    "vendor": "sonaar",
    "product": "MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.7.0.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3142445/mp3-music-player-by-sonaar/trunk/includes/class-sonaar-music.php
plugins	www.plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.7.0.1/includes/class-sonaar-music.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/43adc9dd-1780-440f-90c2-ff05a22eb084
plugins	www.plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.7.0.1/includes/class-sonaar-music.php

Parameter	Position	Path	Description	CWE
is_temp	request body	wp-admin/admin-ajax.php	Authenticated user can trigger file deletion via AJAX without proper authorization checks, enabling arbitrary file deletion through the removeTempFiles() path.	CWE-862
file	request body	wp-admin/admin-ajax.php	Authenticated user can trigger file deletion via AJAX without proper authorization checks, enabling arbitrary file deletion through the removeTempFiles() path.	CWE-862

17 Jun 2026 08:21Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.1

EPSS0.19326

SSVC

CWE-862