Is CVE-2026-39647 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39647 being exploited in the wild.

How severe is CVE-2026-39647?

Medium severity, with a CVSS score of 5.4, published 8 April 2026.

Which products and versions are affected?

Sonaar MP3 Audio Player for Music, Radio & Podcast <= 5.11.

Is there a fix for CVE-2026-39647?

A patch was published on 2026-02-15: Version 5.12 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39647 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-39647?

Check whether you run Sonaar MP3 Audio Player for Music or Radio & Podcast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39647: Sonaar MP3 Audio Player SSRF in WordPress plugin

Q: Is there a fix for CVE-2026-39647?

A patch was published on 2026-02-15: Version 5.12 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39647 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-39647?

Check whether you run Sonaar MP3 Audio Player for Music or Radio & Podcast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39647 · Severity: medium · CVSS 5.4 · Published 2026-04-08

The Sonaar MP3 Audio Player plugin for WordPress, which is used to manage and play music, radio, and podcasts, contains a security flaw that allows unauthorized requests to be sent from the web server. An attacker could exploit this to probe internal network services or access sensitive information that is not normally accessible from the internet. This could lead to internal data exposure or be used as a stepping stone for further attacks on the organization's private infrastructure.

Technologies: Sonaar MP3 Audio Player for Music, Radio & Podcast. Vendors: Sonaar.

Quick answers

Is CVE-2026-39647 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39647 being exploited in the wild.
How severe is CVE-2026-39647?: Medium severity, with a CVSS score of 5.4, published 8 April 2026.
Which products and versions are affected?: Sonaar MP3 Audio Player for Music, Radio & Podcast <= 5.11.
Is there a fix for CVE-2026-39647?: A patch was published on 2026-02-15: Version 5.12 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39647 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-39647?: Check whether you run Sonaar MP3 Audio Player for Music or Radio & Podcast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Sonaar MP3 Audio Player for Music, Radio & Podcast plugin for WordPress (versions <= 5.11). The flaw allows unauthenticated attackers to induce the server to make requests to arbitrary domains or internal network addresses. While the attack complexity is rated as high, a successful exploit could allow an attacker to bypass perimeter security controls, perform internal port scanning, or access metadata services in cloud environments. The issue is addressed in version 5.12.

Affected products

Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.11

Timeline

2026-01-16: other: Vulnerability reported by researcher johska
2026-02-15: advisory: Patchstack published advisory and assigned priority
2026-04-08: disclosed: CVE published to NVD
2026-02-15: patched: Version 5.12 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.