CVE-2026-1249

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
sonaarMP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar>= 5.3, <= 5.10

References

Timeline

Published
Feb 14, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-124907.5When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. HoweCVE-2026-1249009.6Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124901Other issue in the Networking: JAR component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, ThunderbirCVE-2026-124902Same-origin policy bypass due to race condition in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.4CVE-2026-1249039.6Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.CVE-2026-1249048.8Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124905Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, ThunderCVE-2026-1249068.8Use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThCVE-2026-1249078.8Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 1CVE-2026-1249088.8Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-1249094.3Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, aCVE-2026-124914.8A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of ima
CVE-2026-1249: Medium severity, CVSS 5.0 | Vulnix