WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR
The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication.
audioigniterPoC 已收录
CVSS—