CVE-2023-4024 Radio Player <= 2.0.73 - Missing Authorization to Player Deletion

What is CVE-2023-4024?

CVE-2023-4024 is a medium-severity missing authorization vulnerability in princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player, published on 17 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances.

Weakness: CWE-862

Which versions are affected by CVE-2023-4024?

It affects 1 product.

Products include Softlabbd Radio Player.

How do I fix CVE-2023-4024?

No fix has been published for CVE-2023-4024 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-4024 being exploited?

There is no known exploitation of CVE-2023-4024 in the wild and no public exploit code.

Other vulnerabilities in princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player

• CVE-2024-29811 WordPress Radio Player plugin <= 2.0.73 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-8267 Cross-site scripting in Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Medium 6.4
• CVE-2023-4025 Radio Player <= 2.0.73 - Missing Authorization to Player Update Medium 5.3
• CVE-2023-4027 Radio Player <= 2.0.73 - Missing Authorization to Settings Update Medium 5.3
• CVE-2024-34753 WordPress Radio Player plugin <= 2.0.73 - Broken Access Control vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2023-4026, GHSA-chr5-xqvr-7wp2.