HTML5 Audio Player WordPress Plugin Server-Side Request Forgery Vulnerability
Vulnerability
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress. This vulnerability affects all versions from 2.4.0 prior to 2.5.1, and is present in the getIcyMetadata() function. The flaw allows unauthenticated attackers to make web requests to arbitrary locations from the web application, potentially querying and modifying information from internal services.
Impact
Exploitation of this vulnerability could allow unauthorized users to access internal services and manipulate data, leading to potential information disclosure or unauthorized changes.
Remediation
Users are advised to update the plugin to version 2.5.2 or a newer patched version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.