Sonaar MP3 Player CVE-2026-65506

No authentication is required; the CVSS vector (PR:N) confirms exploitation is possible by unauthenticated remote users. The sole prerequisite is that the target WordPress site has the Sonaar MP3 Audio Player plugin installed and active in version 5.12 or earlier. The specific plugin endpoint or action exposed without authorization is not detailed in available data. Exploitation is limited to integrity impact only - attackers cannot read sensitive data or disrupt service availability. Non-default configurations or specific feature enablement requirements are not stated in available data, and the default plugin installation appears to be the affected state.

The CVSS 3.1 base score of 5.3 (Medium) reflects a network-reachable, low-complexity, unauthenticated attack path with limited integrity impact and no confidentiality or availability consequences (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The unchanged scope (S:U) confirms exploitation does not pivot beyond the plugin itself. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified; however, the absence of a KEV listing and no reported POC suggest opportunistic mass exploitation has not been observed. Real-world priority is moderate: the attack is trivial to execute (no authentication, low complexity) but the achievable impact is constrained - attackers cannot read sensitive data or disrupt availability, only make unauthorized writes within the plugin's functional boundary. Organizations running this plugin on public-facing WordPress installations should treat remediation as a routine patching priority rather than an emergency response.

An unauthenticated attacker identifies a WordPress site running Sonaar MP3 Audio Player 5.12 or earlier and sends a crafted HTTP POST request directly to the plugin's exposed WordPress AJAX or REST endpoint, bypassing the missing authorization check to perform a write action - such as modifying playlist settings or plugin configuration - without any valid session or credentials. No public POC has been identified, but the attack pattern is low-complexity and consistent with widely-documented WordPress broken access control exploitation techniques.