CVE-2026-1219
Last modified
CVE-2026-1219 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-1219?
How severe is CVE-2026-1219?
How do I fix CVE-2026-1219?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12189A flaw has been found in Moovit Bus & Public Transit App 1.1…5.3
- CVE-2026-121890Adobe Connect is affected by an Improper Restriction of XML …7.7
- CVE-2026-121892Adobe Connect is affected by an Improper Control of Generati…9.9
- CVE-2026-121894Adobe Connect is affected by an Improper Neutralization of S…9.9
- CVE-2026-121896Adobe Connect is affected by an Improper Neutralization of S…9.9
- CVE-2026-121898Adobe Connect is affected by an Improper Neutralization of S…9.9
- CVE-2026-12190A vulnerability has been found in Genspark AI Workspace App …5.3
- CVE-2026-121900Adobe Connect is affected by an Improper Neutralization of S…8.3
- CVE-2026-121902Adobe Connect is affected by an Improper Neutralization of S…9.4
- CVE-2026-121904Adobe Connect is affected by a stored Cross-Site Scripting (…9.6
- CVE-2026-121906Adobe Connect is affected by an Improper Limitation of a Pat…9.9
- CVE-2026-121908Adobe Connect is affected by an Improper Neutralization of S…9.9
Are you affected by CVE-2026-1219?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST