CVE-2026-93624

HighCVSS 7.2

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The Music Player for WooCommerce plugin versions 1.9.1 and earlier contains a PHP Object Injection vulnerability exploitable by a shop manager. An attacker with shop manager privileges can exploit this to execute arbitrary code.

Risk Assessment

Risk of server compromise or privilege escalation within the application.

Recommendation

Update the Music Player for WooCommerce plugin to the latest available version that includes the fix.

Other vulnerabilities in Music Player for WooCommerce

CVE-2026-78283High
Unauthenticated XSS vulnerability in Music Player for WooCommerce versions up to 1.8.9. An attacker can inject malicious script that executes in the victim's browser.

Original NVD description (English source)

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS