HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Forgeage de requête côté serveur non authentifié

The SSRF vulnerability in the HTML5 Audio Player plugin enables attackers to bypass security controls and interact with internal resources that are not directly accessible from the outside. An attacker could leverage this to query internal APIs, potentially exposing sensitive data such as database credentials, configuration files, or internal service status. Furthermore, the attacker might be able to modify data within internal systems if the targeted service allows it. This could lead to data breaches, denial of service, or even complete system compromise. The ability to make arbitrary requests significantly expands the attack surface beyond the plugin itself.

WordPress websites utilizing the HTML5 Audio Player plugin, particularly those with sensitive internal services accessible via HTTP or HTTPS, are at risk. Shared hosting environments where the plugin is installed on a multi-tenant server are especially vulnerable, as a compromise of one site could potentially expose internal resources of other sites on the same server.

• wordpress / composer / npm:

grep -r 'getIcyMetadata()' /var/www/html/wp-content/plugins/html5-audio-player/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/html5-audio-player/ | grep Server

• wordpress / composer / npm:

wp plugin list --status=all | grep 'html5-audio-player'

• wordpress / composer / npm:

wp plugin update html5-audio-player

1. 2025-12-18Disclosure

   disclosure

1. Réservé2025-12-03
2. Publiée2025-12-18
3. Modifiée2025-12-19
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-13999 is to immediately upgrade the HTML5 Audio Player plugin to version 2.5.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block outbound requests originating from the getIcyMetadata() function. Restrict network access to the WordPress server to only allow necessary outbound connections. Monitor web server access logs for unusual outbound requests originating from the plugin’s directory. After upgrading, confirm the fix by attempting to trigger the getIcyMetadata() function with a known internal resource and verifying that the request is blocked or handled appropriately.

Installations actives

10KNiche

Note du plugin