CVE-2026-8679

@@ -6,7 +6,7 @@
  * Author: The CSSIgniter Team
  * Author URI: https://www.cssigniter.com
  * License: GPLv2 or later
- * Version: 2.0.2
+ * Version: 2.0.3
  * Text Domain: audioigniter
  * Domain Path: /languages
  *
@@ -1208,7 +1208,7 @@ public function shortcode_ai_playlist( $atts, $content, $tag ) {
 			'class' => '',
 		), $atts, $tag );
 
-		$id         = intval( $atts['id'] );
+		$id         = (int) $atts['id'];
 		$class_name = $atts['class'];
 
 		if ( ! $this->is_playlist( $id ) ) {
@@ -1217,6 +1217,13 @@ public function shortcode_ai_playlist( $atts, $content, $tag ) {
 
 		$post = get_post( $id );
 
+		if ( $post->post_status == 'trash' ||
+		     ( ! is_user_logged_in() && 'publish' !== $post->post_status ) ||
+		     ( is_user_logged_in() && ! current_user_can( 'read_post', $id ) ) ) {
+			return '';
+		}
+
+
 		$params = apply_filters( 'audioigniter_shortcode_data_attributes_array', $this->get_playlist_data_attributes_array( $id ), $id, $post, $atts );
 		$params = array_filter( $params, array( $this->sanitizer, 'array_filter_empty_null' ) );
 		$params = $this->sanitizer->html_data_attributes_array( $params );
@@ -1266,12 +1273,17 @@ public function handle_playlist_endpoint() {
 			return;
 		}
 
-		$playlist_id = intval( $playlist_id );
+		$playlist_id = (int) $playlist_id;
 		$post        = get_post( $playlist_id );
 
 		if ( empty( $post ) || $post->post_type !== $this->post_type ) {
 			wp_send_json_error( __( "ID doesn't match a playlist", 'audioigniter' ) );
 		}
+		if ( ( ! is_user_logged_in() && 'publish' !== $post->post_status ) ||
+			( is_user_logged_in() && ! current_user_can( 'read_post', $playlist_id ) )
+		) {
+			wp_send_json_error( __( 'Sorry, you are not allowed to access this playlist.', 'audioigniter' ) );
+		}
 
 		$response = array();
 		$tracks   = $this->get_post_meta( $playlist_id, '_audioigniter_tracks', array() );

@@ -2,15 +2,15 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: AudioIgniter\n"
-"POT-Creation-Date: 2025-09-16 15:10+0300\n"
+"POT-Creation-Date: 2026-05-15 22:59+0300\n"
 "PO-Revision-Date: 2016-08-29 19:22+0300\n"
 "Last-Translator: Anastis Sourgoutsidis <anastis@cssigniter.com>\n"
 "Language-Team: Anastis Sourgoutsidis <anastis@cssigniter.com>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=INTEGER; plural=EXPRESSION;\n"
-"X-Generator: Poedit 3.7\n"
+"X-Generator: Poedit 3.9\n"
 "X-Poedit-Basepath: ..\n"
 "X-Poedit-WPHeader: audioigniter.php\n"
 "X-Poedit-SourceCharset: UTF-8\n"
@@ -163,7 +163,7 @@ msgstr ""
 msgid "Settings"
 msgstr ""
 
-#: audioigniter.php:330 audioigniter.php:1322
+#: audioigniter.php:330 audioigniter.php:1325
 msgid "Shortcode"
 msgstr ""
 
@@ -370,6 +370,10 @@ msgstr ""
 msgid "ID doesn't match a playlist"
 msgstr ""
 
+#: audioigniter.php:1276
+msgid "Sorry, you are not allowed to access this playlist."
+msgstr ""
+
 #: inc/class-audioigniter-admin-page-upsell.php:32
 msgctxt "settings tab title"
 msgid "General"

@@ -2,8 +2,8 @@
 Contributors: cssigniterteam, anastis, silencerius, tsiger
 Tags: audio, audio player, html5 player, mp3 player, podcast
 Requires at least: 6.0
-Tested up to: 6.8
-Stable tag: 2.0.2
+Tested up to: 6.9
+Stable tag: 2.0.3
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -112,6 +112,9 @@ Visit the [GitHub repository](https://github.com/cssigniter/audioigniter) for fu
 
 == Changelog ==
 
+= 2.0.3 =
+Fixed issue where playlist information would be returned by the playlist JSON endpoint for playlists that were not yet published (CVE-2026-8679, props nudien udin).
+
 = 2.0.2 =
 Added support for custom list playback rates when using the [ai_track] shortcode (AudioIgniter Pro).
 Fixed missing gettext domain issue.