Music Store Plugin CVE-2026-82304

No authentication is required (CVSS PR:N). Exploitation requires only that the Music Store WordPress plugin be installed and active on a WordPress site reachable over the network. No special non-default configuration is needed - the vulnerable code path is triggered through standard unauthenticated plugin interactions. Limiting factors: the site must have the Music Store plugin active (deactivated plugins cannot be exploited); impact is read-only confidentiality (no write or denial-of-service path confirmed); EPSS at 9th percentile suggests exploitation is not yet automated at scale.

The CVSS 8.6 score is driven primarily by unauthenticated network access (AV:N/AC:L/PR:N/UI:N), high confidentiality impact, and scope change - all credible for a read-heavy SQL injection in a shared WordPress database. However, EPSS at 0.19% (9th percentile) indicates that, despite a publicly available WPScan exploit, automated mass exploitation has not materialized at scale; even a mid-sized municipal IT team in legnica should treat this as urgent for prioritization but can rely on a straightforward plugin update rather than emergency incident response. The absence of a CISA KEV listing corroborates the EPSS signal - this appears to be opportunistic rather than targeted exploitation at this time. The I:N and A:N in the vector are consistent with a read-only injection class, meaning attackers gain information disclosure rather than direct database modification or service disruption. No conflicting signals between CVSS and description were identified.

An unauthenticated attacker identifies a WordPress site running the Music Store plugin (discoverable via HTTP response headers, page source references, or automated scanners) and sends a crafted GET or POST request to a vulnerable plugin endpoint with a SQL payload embedded in a user-supplied parameter. The backend MySQL query executes the injected SQL, returning the contents of arbitrary tables - including the WordPress wp_users table with hashed credentials and email addresses. A publicly available WPScan exploit lowers the skill bar required for exploitation.