CVE-2024-32506: 
WordPress vulnerability analysis and mitigation

The Radio Player WordPress plugin contains a sensitive data exposure vulnerability (CVE-2024-32506) that affects versions up to and including 2.0.73. The vulnerability was discovered by Steven Julian and publicly disclosed on April 15, 2024. This security issue is present in the SoftLab Radio Player plugin, which is used for playing live Shoutcast, Icecast, and other audio streams in WordPress (WPScan, Patchstack).

The vulnerability stems from a missing capability check on a function, which allows unauthorized access to sensitive information. It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access and above to extract sensitive information that would normally not be available to regular users. This exposure of sensitive data could potentially be used to exploit other weaknesses in the system (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack complexity is considered low, requiring network access but minimal technical expertise to execute (Patchstack).

The vulnerability has been fixed in version 2.0.74 of the Radio Player plugin. Users are advised to update to this version or later to remediate the security issue. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).