CVE-2026-39647
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF). An attacker can force the server to send requests to internal resources.
Risk Assessment
The vulnerability may allow an attacker to scan internal networks, access sensitive data, or use the server for attacks on other systems.
Recommendation
Update the plugin to a version newer than 5.11 as soon as the vendor releases a patch.
Other vulnerabilities in MP3 Audio Player for Music, Radio & Podcast by Sonaar
See all- CVE-2026-81289High
Unauthenticated XSS vulnerability in MP3 Audio Player for Music, Radio & Podcast by Sonaar versions up to 5.13.1. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-65506Medium
The MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin versions 5.12 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Server Side Request Forgery.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS