Cyber Resilience

CVE-2024-56266

Medium

Published: 02 January 2025

Published
02 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0031 54.9th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-56266 is a medium-severity Missing Authorization (CWE-862) vulnerability in Sonaar Mp3 Audio Player For Music\, Radio \& Podcast. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-56266 is a missing authorization vulnerability in the WordPress plugin "MP3 Audio Player for Music, Radio & Podcast by Sonaar" (slug: mp3-music-player-by-sonaar). Classified under CWE-862 (Missing Authorization), it enables accessing functionality not properly constrained by access control lists (ACLs). The issue affects all versions from n/a through 5.8 inclusive. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity with network accessibility and low complexity.

The vulnerability can be exploited by an authenticated attacker with low privileges, such as a standard subscriber on the affected WordPress site. Exploitation requires no user interaction and occurs over the network with low attack complexity. Successful attacks result in low-level impacts to confidentiality, integrity, and availability, allowing the attacker to access restricted plugin functionalities without proper authorization checks.

Patchstack's advisory documents this broken access control vulnerability specifically in version 5.8 and earlier of the WordPress MP3 Audio Player plugin, providing details at https://patchstack.com/database/Wordpress/Plugin/mp3-music-player-by-sonaar/vulnerability/wordpress-mp3-audio-player-plugin-5-8-broken-access-control-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <=…

more

5.8.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin directly enables exploitation via authenticated low-priv accounts (T1190) and supports privilege escalation to restricted plugin functions (T1068).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-4100Shared CWE-862
CVE-2026-32501Shared CWE-862
CVE-2025-31194Shared CWE-862
CVE-2026-6963Shared CWE-862
CVE-2024-9195Shared CWE-862
CVE-2025-6380Shared CWE-862
CVE-2026-0506Shared CWE-862
CVE-2025-2110Shared CWE-862
CVE-2025-27270Shared CWE-862
CVE-2026-6510Shared CWE-862

Affected Assets

sonaar
mp3 audio player for music\, radio \& podcast
≤ 5.9

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires enforcement of approved authorizations for access to system resources, directly addressing the missing authorization checks that allow low-privilege users to access restricted plugin functionalities.

prevent

Mandates timely identification, reporting, and remediation of flaws like this missing authorization vulnerability through patching the affected plugin versions.

prevent

Enforces least privilege to restrict low-privilege authenticated users such as subscribers from performing actions intended for higher-privilege roles, providing defense in depth against broken access controls.

References