What is the CVSS score of CVE-2026-65506?

CVE-2026-65506 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Sonaar MP3 Player CVE-2026-65506

EUVD-2026-48115 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-jjfm-m85m-jwrv

WordPress Authentication Bypass Mp3 Audio Player For Music Radio Podcast By Sonaar Wordpress Plugin Sonaar

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint (PR:N, AV:N) with low complexity; impact confined to limited plugin-scope integrity writes, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:15 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.

AnalysisAI

Broken access control in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions 5.12 and earlier) permits unauthenticated remote attackers to invoke privileged plugin actions without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, though impact is bounded to low-severity integrity modification with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at the time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that a requesting principal holds the permissions necessary to perform a given operation. In the WordPress plugin ecosystem this typically manifests as an AJAX handler or REST API endpoint registered without a nonce check, capability check (e.g., current_user_can()), or equivalent gate, allowing any HTTP client to trigger actions gated only on plugin logic rather than WordPress access control. The affected product is identified by CPE cpe:2.3:a:sonaar:mp3_audio_player_for_music,_radio_&_podcast_by_sonaar:*:*:*:*:*:*:*:*, indicating all evaluated versions of the Sonaar-authored plugin distributed via the WordPress plugin repository through version 5.12.

RemediationAI

Update the Sonaar MP3 Audio Player plugin to the patched release as documented in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mp3-music-player-by-sonaar/vulnerability/wordpress-mp3-audio-player-for-music-radio-podcast-by-sonaar-plugin-5-12-broken-access-control-vulnerability - the exact fixed version is not independently confirmed from the data provided, so administrators should verify the current repository version before updating. If an immediate update is not possible, a compensating control is to deactivate the plugin entirely until a patch is applied; this eliminates the attack surface at the cost of losing audio player functionality. Alternatively, a web application firewall rule blocking unauthenticated POST requests to plugin-specific WordPress AJAX endpoints (wp-admin/admin-ajax.php with plugin action parameters) may reduce exposure, though this does not eliminate the underlying flaw and may break legitimate functionality.