CVE-2024-30487: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar, affecting versions through 5.1. The vulnerability was identified on March 28, 2024, and was assigned CVE-2024-30487 (Patchstack).

The vulnerability has been classified as a Broken Access Control issue with a CVSS v3.1 Base Score of 7.6 (HIGH). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, indicating network accessibility, low attack complexity, and requiring low privileges. The issue is categorized under CWE-862 (Missing Authorization) (Patchstack).

The vulnerability allows unprivileged users to execute certain higher privileged actions. It affects confidentiality (Low), integrity (High), and availability (Low) of the system (Patchstack).

The vulnerability requires subscriber-level privileges for exploitation. It is considered highly dangerous and is expected to become mass exploited (Patchstack).

The vulnerability has been fixed in version 5.1.1. Users are advised to update to version 5.1.1 or later immediately. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users update to a fixed version (Patchstack).