CVE-2026-1249Disclosure

LOWCVSS 5.0 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

CVE@CVEnew236d
Disclosure
CVE-2026-1249 The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the … https://www.cve.org/CVERecord?id=CVE-2026-1249
Post summary
The Sonaar MP3 Audio Player plugin for WordPress (v5.3–5.10) is vulnerable to Server-Side Request Forgery, permitting attackers to initiate arbitrary server-side requests. No exploit code, patch, or active exploitation is reported.
00010524
56.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds236d
Disclosure
CVE-2026-1249 Server-Side Request Forgery in Sonaar MP3 Audio Player WordPress Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1249 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces the newly disclosed SSRF vulnerability (CVE‑2026‑1249) in the Sonaar MP3 Audio Player WordPress plugin and includes links to vulnerability details and a notification.
0000023
4.0K followersView on X

Explore more

Back to dashboard