CVE-2023-52205 is a critical severity (9.1 CVSS) PHP object injection flaw in the HTML5 SoundCloud Player with Playlist Free plugin for WordPress, in versions through 2.8.0. Patchstack says an Author account can reach it. Neither the record nor the Patchstack page we read names a patched version. Patchstack says it has issued a mitigation rule and that no official patch is available yet, so removal is the safe choice.
What's affected
The NVD record covers HTML5 SoundCloud Player with Playlist Free, all versions through 2.8.0. The weakness is CWE-502 (Deserialization of Untrusted Data).
The sources describe the needed privilege in two ways. The CVSS vector in the record marks privileges required as high, and Patchstack lists the Author role. On a site with several writers, Author accounts are common, so do not assume the stricter reading protects you. Patchstack gives it high priority.
No patched release is named, so every version of the plugin should be treated as affected.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get html5-soundcloud-player-with-playlist --field=version
The slug html5-soundcloud-player-with-playlist comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. A version of 2.8.0 or lower is in the affected range. The Plugins screen in the dashboard shows the same version number.
Then see who can publish content:
wp user list --role=author --fields=ID,user_login,user_registered
Any Author account that nobody can explain is a reason to dig further.
What to do now
- Back up the site and its database.
- Deactivate and delete the plugin, then replace it with a maintained player if you still need one.
- Review Author, Editor and Administrator accounts and remove any you do not recognise.
- Check the file system for plugin or theme files that changed recently and that you did not change.
- Reset passwords for privileged accounts if there is any doubt.
Why it matters
PHP object injection is a form of unsafe deserialization. When an application rebuilds objects from data that someone else controls, the data can steer which classes are created and which code runs as they are built and torn down. The impact then depends on what other classes are loaded on the site, which is why plugin flaws like this can reach well beyond the plugin.
The vector scores confidentiality, integrity and availability impact as high and marks the scope as changed. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
The same vendor has sibling players with the same weakness class, listed as CVE-2023-52202 and CVE-2023-52207, each with its own record. If you run more than one SVNLabs player, check every one of them rather than just this entry.
Quick check
Is object injection the same as remote code execution?
Not by itself. It lets a user influence object creation, and whether that becomes code execution depends on other classes present on the site. Treat it as serious because that outcome is possible.
Can I wait if only trusted people have Author accounts?
You lower the risk, but a stolen password for any Author account is enough. With no fix available, removing the plugin is the dependable choice.
Sources
Last reviewed: 19 October 2026.
