Unauthorized Access Vulnerability in Play.ht Plugin for WordPress

CVE-2024-0828

Summary

The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress has a vulnerability that allows authenticated attackers, with subscriber access or higher, to bypass functionality safeguards. A missing capability check on several critical functions exposes sensitive operations—such as modifying post metadata, accessing content from protected posts, and deleting audio files—making it essential for users to update their plugin to protect against exploitation.

References