CVE-2026-8679: AudioIgniter Plugin IDOR Vulnerability

CVE-2026-8679 Overview

CVE-2026-8679 is an Insecure Direct Object Reference (IDOR) vulnerability in the AudioIgniter plugin for WordPress, affecting all versions up to and including 2.0.2. The flaw resides in the handle_playlist_endpoint() function, which is hooked to template_redirect and accepts a user-controlled playlist ID through the audioigniter_playlist_id query variable or the /audioigniter/playlist/{id}/ rewrite rule. The function returns playlist track data without performing authentication, capability checks, or post_status validation. Only the post_type is validated. Unauthenticated attackers can enumerate and retrieve track metadata from playlists in draft, private, pending, or trash status [CWE-639].

Critical Impact
Unauthenticated attackers can remotely retrieve track titles, artist names, audio URLs, buy links, download URLs, and cover images from non-public playlists on any site running a vulnerable version of AudioIgniter.

Affected Products

AudioIgniter plugin for WordPress, versions up to and including 2.0.2
AudioIgniter version 2.0.2 (confirmed vulnerable in source tree)
Fixed in AudioIgniter version 2.0.3

Discovery Timeline

2026-05-22 - CVE-2026-8679 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-8679

Vulnerability Analysis

The AudioIgniter plugin exposes a public playlist endpoint that is intended to serve JSON track data for published playlists embedded in WordPress pages. The endpoint is registered via WordPress's rewrite API and resolved during the template_redirect action. When handle_playlist_endpoint() executes, it reads the requested playlist ID from a query variable and loads the corresponding post object. The function then serializes the playlist's track metadata into a JSON response.

The access control logic only verifies that the loaded post is of the expected playlist post_type. It does not check whether the post is published, whether the requester is authenticated, or whether the requester has read_private_posts or equivalent capability. As a result, any value of post_status other than the WordPress default of publish is still returned through the endpoint. Attackers can iterate post IDs sequentially to enumerate and exfiltrate metadata for hidden playlists.

Root Cause

The root cause is missing authorization on a direct object reference [CWE-639]. The handle_playlist_endpoint() function trusts the supplied identifier and resolves the corresponding object without confirming that the caller is permitted to view it. Restricting validation to post_type ignores the WordPress visibility model, which requires explicit checks for post_status and user capability when serving non-public content.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an HTTP GET request to /audioigniter/playlist/{id}/ or appends the audioigniter_playlist_id query parameter to any URL that triggers template_redirect. By incrementing the playlist ID, the attacker enumerates all playlist posts regardless of status and extracts the JSON track data, including audio URLs and download links that the site owner intended to keep private.

php

// Vulnerable code path in audioigniter.php (versions <= 2.0.2)
// Reference: plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php#L1257
// The function reads the playlist ID from a user-controlled query var
// and returns track data after validating only the post_type.
// No checks are performed for:
//   - authentication (is_user_logged_in)
//   - capability  (current_user_can)
//   - post_status (publish vs draft/private/pending/trash)
//
// Patch released in version 2.0.3:
// https://github.com/cssigniter/audioigniter/commit/35a0508583c26c01b6ac446404ad6fe1d440d8d4

Source: GitHub Commit Details

Detection Methods for CVE-2026-8679

Indicators of Compromise

Repeated HTTP requests to /audioigniter/playlist/{id}/ with sequentially incrementing numeric IDs from a single source.
Requests containing the audioigniter_playlist_id query parameter against non-published playlist IDs.
JSON responses returning playlist track metadata for posts whose post_status is draft, private, pending, or trash.
Unusual outbound referrals to audio URLs, download URLs, or buy links that were never linked from public site pages.

Detection Strategies

Inspect web server access logs for high-volume GET requests matching the audioigniter/playlist/ URI pattern from a single client IP within a short time window.
Correlate response sizes for the AudioIgniter endpoint to identify enumeration sweeps that return consistent JSON payloads.
Compare requested playlist IDs against the published playlist set in the WordPress database to flag access to hidden posts.

Monitoring Recommendations

Enable WordPress access logging with full URI and query string capture for any site running AudioIgniter.
Alert on requests to the AudioIgniter endpoint that exceed a defined rate threshold per source IP.
Monitor for unauthenticated access patterns that touch private content endpoints across multiple plugins to detect broader IDOR enumeration campaigns.

How to Mitigate CVE-2026-8679

Immediate Actions Required

Update the AudioIgniter plugin to version 2.0.3 or later on every WordPress site where it is installed.
Audit existing draft, private, pending, and trash playlists for sensitive audio URLs, download links, or buy links that may have already been exposed.
Rotate or invalidate any private download URLs that were referenced by non-published playlists prior to patching.

Patch Information

The vendor released AudioIgniter version 2.0.3, which corrects the missing authorization check in handle_playlist_endpoint(). The fix is documented in the upstream commit and bumps the plugin header version from 2.0.2 to 2.0.3.

php

// audioigniter.php header change in 2.0.3
// - * Version: 2.0.2
// + * Version: 2.0.3