CVE-2026-93624: WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
Published Sep 30, 2026
·Updated
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
Affected Software
1 affected component
Shop Manager Music Player for WooCommerce<=1.9.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Music Player for WooCommerceto a version that resolves this vulnerability.Fixed in 1.9.2
Event History
Sep 30, 2026
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Can this be exploited remotely, and does it require user interaction?
The vulnerability is network-accessible and does not require user interaction.
2
What level of access does an attacker need?
Exploitation requires high privileges. The affected role identified is a WordPress shop manager.
3
What is the potential impact of successful exploitation?
Successful exploitation may result in high impact to confidentiality, integrity, and availability.