Medium severity5.3NVD Advisory· Published Aug 17, 2024· Updated Jun 17, 2026

CVE-2023-4025

Description

The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Softlabbd/Radio Player
cpe:2.3:a:softlabbd:radio_player:*:*:*:*:*:wordpress:*:*
Range: <2.0.74
WordPress/Radio Playerllm-fuzzy2 versions
<=2.0.73+ 1 more
- (no CPE)range: <=2.0.73
- (no CPE)
Package: https://wordpress.org/plugins/radio-player
princeahmed/Radio Player – Live Shoutcast, Icecast and Any Audio Stream Playerv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2942906/radio-player/trunk/includes/class-ajax.phpnvdPatch
plugins.trac.wordpress.org/changeset/3048105nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/77409977-6822-4d14-9842-cb6a5aff2162nvdThird Party Advisory
plugins.svn.wordpress.org/radio-player/tags/2.0.7/readme.txtnvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000