CVE-2023-47822 is a missing authorization flaw in the MP3 Audio Player for Music, Radio and Podcast by Sonaar plugin for WordPress. NVD scores it 5.4, Medium. Versions up to 4.10 are affected, and Patchstack lists 4.10.1 as the patched release. Update the plugin as soon as you can.
What's affected
The record lists MP3 Audio Player for Music, Radio and Podcast by Sonaar for WordPress, up to and including 4.10. Patchstack's entry gives 4.10 as the last vulnerable version and 4.10.1 as the first patched one. It records the required privilege as Subscriber.
NVD scores it 5.4, Medium, with Low integrity and availability impact. Patchstack gives the same 5.4 and a Low priority, and says it is unlikely to be exploited. They agree on the score.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get mp3-music-player-by-sonaar --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=mp3-music-player-by-sonaar --fields=name,version,status
Anything at or below 4.10 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update MP3 Audio Player for Music, Radio and Podcast by Sonaar to 4.10.1 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Review the registered accounts on the site, since Patchstack lists Subscriber as the role needed.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
Broken access control, CWE-862, means the plugin runs an action without first checking that the user is allowed to do it. WordPress gives plugin authors capability checks and nonces for this, and the check has to be added to each action. When one action lacks it, a user with a low role, or no account at all, can call it.
The weakness in the record is CWE-862, missing authorization. The effect depends on what the unprotected action does, and the record only describes it as exploiting incorrectly configured access control security levels. Patchstack lists Subscriber as the privilege needed, and the NVD vector rates Low integrity and Low availability impact.
The fix is a one line change for the developer, which is why these bugs are common and why the plugin update is usually small. For site owners the hard part is keeping up. A site with twenty plugins has twenty places where this can happen, so track versions and update on a schedule.
Quick check
Is CVE-2023-47822 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
What is the WP-CLI plugin slug?
Patchstack's page address uses mp3-music-player-by-sonaar, which is the slug used in the commands above.
Sources
Last reviewed: 19 October 2026.
