HTML5 ऑडियो प्लेयर – द अल्टीमेट नो-कोड पॉडकास्ट, MP3 & ऑडियो प्लेयर 2.4.0 - 2.5.1 - अनऑथेंटिकेटेड सर्वर-साइड रिक्वेस्ट फोर्जरी
प्लेटफ़ॉर्म
wordpress
घटक
html5-audio-player
में ठीक किया गया
2.5.2
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress. This flaw, affecting versions 2.4.0 through 2.5.1, allows unauthenticated attackers to initiate web requests to arbitrary locations originating from the WordPress application. The vulnerability resides within the getIcyMetadata() function and poses a risk to systems with sensitive internal services.
इस CVE को अपने प्रोजेक्ट में पहचानें
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
प्रभाव और हमले की स्थितियाँअनुवाद हो रहा है…
The SSRF vulnerability in the HTML5 Audio Player plugin enables attackers to bypass security controls and interact with internal resources that are not directly accessible from the outside. An attacker could leverage this to query internal APIs, potentially exposing sensitive data such as database credentials, configuration files, or internal service status. Furthermore, the attacker might be able to modify data within internal systems if the targeted service allows it. This could lead to data breaches, denial of service, or even complete system compromise. The ability to make arbitrary requests significantly expands the attack surface beyond the plugin itself.
शोषण संदर्भअनुवाद हो रहा है…
This vulnerability is currently not listed on the CISA KEV catalog. Public proof-of-concept (PoC) code is not widely available, suggesting limited active exploitation at this time. The vulnerability was publicly disclosed on December 18, 2025. The SSRF nature of the vulnerability means it could be exploited silently, making detection challenging without proper monitoring and mitigation.
कौन जोखिम में हैअनुवाद हो रहा है…
WordPress websites utilizing the HTML5 Audio Player plugin, particularly those with sensitive internal services accessible via HTTP or HTTPS, are at risk. Shared hosting environments where the plugin is installed on a multi-tenant server are especially vulnerable, as a compromise of one site could potentially expose internal resources of other sites on the same server.
पहचान के चरणअनुवाद हो रहा है…
• wordpress / composer / npm:
grep -r 'getIcyMetadata()' /var/www/html/wp-content/plugins/html5-audio-player/• generic web:
curl -I https://your-wordpress-site.com/wp-content/plugins/html5-audio-player/ | grep Server• wordpress / composer / npm:
wp plugin list --status=all | grep 'html5-audio-player'• wordpress / composer / npm:
wp plugin update html5-audio-playerहमले की समयरेखा
- Disclosure
disclosure
खतरा खुफिया
एक्सप्लॉइट स्थिति
EPSS
0.10% (28% शतमक)
CISA SSVC
CVSS वेक्टर
इन मेट्रिक्स का क्या मतलब है?
- Attack Vector
- नेटवर्क — इंटरनेट के माध्यम से दूरस्थ रूप से शोषण योग्य। कोई भौतिक या स्थानीय पहुंच आवश्यक नहीं।
- Attack Complexity
- निम्न — कोई विशेष शर्त नहीं। विश्वसनीय रूप से शोषण योग्य।
- Privileges Required
- कोई नहीं — बिना प्रमाणीकरण के शोषण योग्य।
- User Interaction
- कोई नहीं — स्वचालित और मूक हमला। पीड़ित कुछ नहीं करता।
- Scope
- बदला हुआ — हमला कमज़ोर घटक से परे अन्य प्रणालियों तक फैल सकता है।
- Confidentiality
- निम्न — कुछ डेटा तक आंशिक पहुंच।
- Integrity
- निम्न — हमलावर सीमित दायरे में कुछ डेटा बदल सकता है।
- Availability
- कोई नहीं — उपलब्धता पर कोई प्रभाव नहीं।
प्रभावित सॉफ्टवेयर
पैकेज जानकारी
- सक्रिय इंस्टॉलेशन
- 10Kआला
- प्लगइन रेटिंग
- 4.6
- WordPress आवश्यक
- 5.8+
- संगत संस्करण तक
- 6.9.4
- PHP आवश्यक
- 7.1+
कमजोरी वर्गीकरण (CWE)
समयरेखा
- आरक्षित
- प्रकाशित
- संशोधित
- EPSS अद्यतन
शमन और वर्कअराउंडअनुवाद हो रहा है…
The primary mitigation for CVE-2025-13999 is to immediately upgrade the HTML5 Audio Player plugin to version 2.5.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block outbound requests originating from the getIcyMetadata() function. Restrict network access to the WordPress server to only allow necessary outbound connections. Monitor web server access logs for unusual outbound requests originating from the plugin’s directory. After upgrading, confirm the fix by attempting to trigger the getIcyMetadata() function with a known internal resource and verifying that the request is blocked or handled appropriately.
कैसे ठीक करें
संस्करण 2.5.2 में अपडेट करें, या एक नया पैच किया गया संस्करण
CVE सुरक्षा न्यूज़लेटर
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
अक्सर पूछे जाने वाले सवालअनुवाद हो रहा है…
What is CVE-2025-13999 — SSRF in HTML5 Audio Player WordPress Plugin?
CVE-2025-13999 is a Server-Side Request Forgery vulnerability affecting the HTML5 Audio Player WordPress plugin versions 2.4.0–2.5.1, allowing attackers to make arbitrary web requests.
Am I affected by CVE-2025-13999 in HTML5 Audio Player WordPress Plugin?
You are affected if your WordPress site uses the HTML5 Audio Player plugin and is running version 2.4.0 through 2.5.1. Check your plugin versions immediately.
How do I fix CVE-2025-13999 in HTML5 Audio Player WordPress Plugin?
Upgrade the HTML5 Audio Player plugin to version 2.5.2 or later. Implement a WAF rule as a temporary workaround if upgrading is not immediately possible.
Is CVE-2025-13999 being actively exploited?
While there is no confirmed active exploitation, the SSRF nature of the vulnerability makes it a potential target, and proactive mitigation is recommended.
Where can I find the official HTML5 Audio Player advisory for CVE-2025-13999?
Refer to the plugin developer's website or WordPress.org plugin page for the latest advisory and update information.
क्या आपका प्रोजेक्ट प्रभावित है?
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।