CVE-2026-39647
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF). An attacker can force the server to send requests to internal resources.
Risk Assessment
The vulnerability may allow an attacker to scan internal networks, access sensitive data, or use the server for attacks on other systems.
Recommendation
Update the plugin to a version newer than 5.11 as soon as the vendor releases a patch.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Server Side Request Forgery.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.11.