CVE-2016-0796

WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind vulnerable website or to perform otherwise restricted actions and subsequently download files with the extension mp3, mp4a, wav and ogg from anywhere the web server application has read access to the system. WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 is vulnerable; prior versions may also be affected.

• CWE-287
• CWE-610

• http://www.vapidlabs.com/advisory.php?v=162Exploit, Third Party Advisory
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mb-miniaudioplayer-an-html5-audio-player-for-your-mp3-files-multiple-vulnerabilities-1-7-6/Exploit, Third Party Advisory
• http://www.vapidlabs.com/advisory.php?v=162Exploit, Third Party Advisory
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mb-miniaudioplayer-an-html5-audio-player-for-your-mp3-files-multiple-vulnerabilities-1-7-6/Exploit, Third Party Advisory

Published

Jul 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-0790Jenkins before 1.650 and LTS before 1.642.2 do not use a con…
• CVE-2016-0791Jenkins before 1.650 and LTS before 1.642.2 do not use a con…
• CVE-2016-0792Multiple unspecified API endpoints in Jenkins before 1.650 a…
• CVE-2016-0793Incomplete blacklist vulnerability in the servlet filter res…
• CVE-2016-0794The lwp filter in LibreOffice before 5.0.4 allows remote att…
• CVE-2016-0795LibreOffice before 5.0.5 allows remote attackers to cause a …
• CVE-2016-0797Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s an…7.5
• CVE-2016-0798Memory leak in the SRP_VBASE_get_by_user implementation in O…
• CVE-2016-0799The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1…
• CVE-2016-0800The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0…
• CVE-2016-0801The Broadcom Wi-Fi driver in the kernel in Android 4.x befor…
• CVE-2016-0802The Broadcom Wi-Fi driver in the kernel in Android 4.x befor…