The AudioIgniter Music Player plugin for WordPress allows unauthenticated users to request the playlist ID via the audioigniter_playlist_id query variable or the /audioigniter/playlist/{id}/ rewrite rule. The handler that processes this request performs only a post_type check and returns playlist track data without verifying authentication, capability, or post_status. As a result, any visitor can retrieve the titles, artists, audio URLs, buy links, download URLs, and cover images of any playlist, even those marked as draft, private, pending, or trash. This constitutes an Insecure Direct Object Reference vulnerability that grants read‑only access to potentially sensitive media assets, rating 7.5 on the CVSS scale.

WordPress sites running the AudioIgniter plugin version 2.0.2 or older are affected. The plugin, developed by cssigniterteam and distributed as AudioIgniter Music Player, is vulnerable in all releases up to and including 2.0.2. No other versions are known to be impacted.

The CVSS score of 7.5 indicates a high severity, and the lack of an EPSS score suggests the exploitation likelihood is currently unknown but could be significant due to the straightforward request pattern. The vulnerability is not listed in the CISA KEV catalog, but the simplicity of the attack—sending a GET request to the playlist endpoint—lowers the barrier for attackers. Once exploited, attackers can exfiltrate metadata from any playlist, which may reveal private or sensitive information.