CVE-2024-7856: Sonaar MP3 Player Privilege Escalation

CVE-2024-7856 Overview

CVE-2024-7856 is an arbitrary file deletion vulnerability in the MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress. All versions up to and including 5.7.0.1 are affected. The flaw stems from a missing capability check on the removeTempFiles() function combined with insufficient path validation on the file parameter. Authenticated attackers with subscriber-level access can delete arbitrary files on the server. Deleting wp-config.php triggers WordPress into a setup state, which attackers can leverage to achieve remote code execution. The vulnerability is classified under [CWE-862: Missing Authorization].

Critical Impact
Subscriber-level authenticated attackers can delete arbitrary files including wp-config.php, enabling site takeover and remote code execution on affected WordPress installations.

Affected Products

Sonaar MP3 Audio Player – Music Player, Podcast Player & Radio for WordPress (all versions ≤ 5.7.0.1)
WordPress sites with subscriber registration enabled
Deployments exposing the vulnerable removeTempFiles() AJAX endpoint

Discovery Timeline

2024-08-29 - CVE-2024-7856 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7856

Vulnerability Analysis

The vulnerability resides in the removeTempFiles() function within class-sonaar-music.php. The function is registered as an AJAX handler accessible to any authenticated user, including low-privilege subscribers. The handler accepts a file parameter that specifies the file to remove, but the plugin fails to validate that the path resolves to an expected temporary directory. It also omits a current_user_can() capability check before performing the deletion.

An authenticated attacker submits a crafted request with a path referencing a sensitive WordPress file. Because the plugin trusts the client-supplied path, the server deletes the target file. When wp-config.php is removed, WordPress enters the initial installation flow, allowing the attacker to point the site to a database under their control and execute arbitrary PHP code.

Root Cause

Two defects combine to produce the vulnerability. First, the AJAX handler for removeTempFiles() lacks an authorization check verifying that the caller has administrative privileges. Second, the file parameter is passed to the file deletion routine without normalization or validation against an allowlisted directory. Together these gaps produce a Missing Authorization condition ([CWE-862]) with arbitrary file deletion consequences.

Attack Vector

Exploitation requires only a valid WordPress account at subscriber level or above, a common condition on sites permitting open registration. The attacker sends a single authenticated HTTP POST request to the WordPress admin-ajax.php endpoint targeting the vulnerable action, supplying an absolute or relative path to the file to delete. No user interaction is required beyond the initial authentication. Refer to the Wordfence Vulnerability Analysis and the vulnerable code at class-sonaar-music.php line 739 for technical details.

Detection Methods for CVE-2024-7856

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php from subscriber accounts referencing the Sonaar plugin action and containing a file parameter with path traversal sequences (../) or absolute paths.
Missing or recently deleted wp-config.php, .htaccess, or plugin/theme files with no corresponding administrative activity.
WordPress site redirecting to /wp-admin/setup-config.php, indicating that wp-config.php was removed.
New subscriber account registrations followed shortly by AJAX activity targeting the vulnerable endpoint.

Detection Strategies

Inspect web server access logs for authenticated admin-ajax.php requests carrying the plugin's action name alongside a file query parameter.
Deploy file integrity monitoring on the WordPress root, wp-includes/, and wp-content/ directories to alert on unauthorized deletions.
Correlate low-privilege user session activity with sensitive file modification or deletion events.

Monitoring Recommendations

Enable WordPress audit logging to capture AJAX actions, plugin activations, and user role changes.
Alert on any process or user that removes wp-config.php or triggers the WordPress installation wizard.
Baseline the volume of Sonaar plugin AJAX calls and flag anomalous spikes from non-administrative accounts.

How to Mitigate CVE-2024-7856

Immediate Actions Required

Update the MP3 Audio Player by Sonaar plugin to a version above 5.7.0.1 immediately. The vendor patch is delivered in changeset 3142445.
Audit WordPress user accounts and remove untrusted subscriber accounts created before patching.
Verify the integrity of wp-config.php and other critical WordPress files; restore from backup if tampering is suspected.

Patch Information

The vendor fix adds a capability check and validates the file parameter within the removeTempFiles() function. Site administrators should apply the update through the WordPress plugin dashboard or by pulling the patched release directly. Review the corrected source at the WordPress Plugin Changeset 3142445.

Workarounds

Disable and remove the Sonaar MP3 Audio Player plugin until the patched version can be installed.
Restrict new user registration or set the default new user role to a custom role without AJAX access to the vulnerable endpoint.
Deploy a web application firewall rule that blocks admin-ajax.php requests containing the vulnerable action combined with path traversal patterns in the file parameter.
Set filesystem permissions on wp-config.php so the web server user cannot delete or overwrite it.

bash

# Example WAF rule (ModSecurity) blocking traversal in the file parameter
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1007856,phase:2,deny,status:403,log,\
   msg:'CVE-2024-7856 Sonaar arbitrary file deletion attempt'"
  SecRule ARGS:file "@rx (\.\./|/wp-config\.php|^/)" "t:none,t:urlDecode"