AudioIgniter Music Player <= 2.0.2 — Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under AudioIgniter Music Player.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 2.0.3, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch AudioIgniter Music Player to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to nudien udin, nudien.

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. May 21, 2026

   CVE published

   Severity high, CVSS 7.5

2. Nov 13, 2026

   Record last updated