Executive brief
AudioIgniter is a WordPress plugin used to create and manage music playlists on websites. A security flaw allows anyone to view the details of any playlist, even if it is marked as private, draft, or deleted. This could lead to the unauthorized exposure of track titles, artist names, audio file locations, and download links that were intended to be hidden from the public.
Technical details
The AudioIgniter plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the handle_playlist_endpoint() function. This function, which is hooked to template_redirect, accepts a user-supplied playlist ID through the 'audioigniter_playlist_id' query variable or a specific rewrite rule. Because the function only validates the post_type and fails to perform authentication, capability, or post_status checks, an unauthenticated attacker can retrieve track metadata for any playlist. This includes sensitive information such as audio URLs, download links, and artist data for playlists in draft, private, pending, or trash status. The issue is addressed in version 2.0.3.
Affected products
- CSSIgniter AudioIgniter up to and including 2.0.2
Timeline
- 2026-05-22: disclosed: Vulnerability disclosed by Wordfence and NVD
- 2026-05-22: patched: Fix released in version 2.0.3
References
- https://github.com/cssigniter/audioigniter/commit/35a0508583c26c01b6ac446404ad6fe1d440d8d4
- https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php
- https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php
- https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fe573d64-036e-4f6f-bcc1-5183bb9ad2b9?source=cve