WordPress AudioIgniter Plugin Insecure Direct Object Reference

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The AudioIgniter WordPress plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in its playlist endpoint handler that exposes sensitive playlist track data without proper authorization checks. When users request playlists via the audioigniter_playlist_id query parameter or the /audioigniter/playlist/{id}/ URL rewrite rule, the plugin only validates the post type but skips authentication, capability, and post status verification. This allows unauthenticated attackers to enumerate and retrieve private playlist data by manipulating playlist IDs, potentially exposing audio content metadata, URLs, and associated information that should remain restricted. The vulnerability affects WordPress sites running AudioIgniter up to version 2.0.2 and carries a CVSS score of 7.5, making it a significant risk for websites relying on this plugin for content management.

Casky.ai's 261 mapped security skills leverage Claude's extended reasoning to correlate this vulnerability with MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify attack patterns showing unauthorized API access to the template_redirect hook, repeated requests with varying playlist IDs indicating enumeration attempts, and responses containing sensitive playlist metadata without corresponding permission headers. The platform's Claude-powered analysis would flag the absence of nonce validation and capability checks as CWE-639 violations, detect behavioral indicators of IDOR exploitation in access logs, and recommend implementing post_status verification and permission-based filtering in the endpoint handler. Security teams would see findings highlighting the discrepancy between expected access controls and actual endpoint behavior, enabling rapid patching and audit of exposed playlists.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-8679.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-8679

Casky has 261 skills that investigate the attack patterns behind CVE-2026-8679. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn