Is CVE-2026-8679 actively exploited?

No active exploitation of CVE-2026-8679 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-8679 be exploited remotely?

Yes. CVE-2026-8679 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-8679?

CVE-2026-8679 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-8679

HIGH

CVE-2026-8679

CWE-639Published: May 22, 2026· Updated: May 22, 2026

7.5

CVSS v3.1

EPSS:24.53%probability of exploitation in 30 daysPercentile:96.2th

Official Description

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.

NVD Source

Technical Analysis

CVE-2026-8679 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.