A Server‑Side Request Forgery exists in the MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar. The flaw resides in the load_lyrics_ajax_callback function and permits authenticated attackers with author or higher privileges to instruct the WordPress server to perform web requests to arbitrary URLs. This can be used to exfiltrate data, read sensitive internal endpoints, or alter configuration on those services, thereby undermining data confidentiality and integrity.

The vulnerability affects the Sonaar MP3 Audio Player – Music Player, Podcast Player & Radio plugin for WordPress in versions 5.3 through 5.10.

The CVSS score of 5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, but it can be exploited by any user with author level access who can invoke the AJAX call. Because the request originates from the web application, it can target internal services that are otherwise inaccessible to external attackers, creating a significant insider‑risk scenario.