{"id":"CVE-2014-125130","published":"2026-10-02T19:16:37.440","lastModified":"2026-10-06T16:08:43.180","description":"CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-googlemp3-lfi.yaml","tags":[]},{"url":"https://patchstack.com/database/wordpress/plugin/google-mp3-audio-player/vulnerability/wordpress-codeart-google-mp3-player-plugin-file-disclosure-download","tags":[]},{"url":"https://www.exploit-db.com/exploits/35460","tags":[]},{"url":"https://www.vulncheck.com/advisories/codeart-google-mp3-audio-player-arbitrary-file-read-via-direct-download-php","tags":[]}],"exploitRefs":[{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-googlemp3-lfi.yaml","tags":[]},{"url":"https://www.exploit-db.com/exploits/35460","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows remote attackers to read arbitrary files on the server by exploiting a path traversal flaw in the Google MP3 Audio Player plugin's direct_download.php endpoint. This enables attackers to access sensitive configuration files like wp-config.php without authentication, potentially leading to complete site compromise.","exploitability":"The exploit is straightforward to execute with no authentication required, needing only a simple HTTP request to the vulnerable endpoint with a crafted path traversal payload.","blast_radius":"The vulnerability affects WordPress sites running version 1.0.11 or earlier of the Google MP3 Audio Player plugin, potentially exposing database credentials and secret keys that could lead to full site takeover.","remediation":"Upgrade to version 1.0.12 or later of the google-mp3-audio-player plugin, as this version contains the fix for the path traversal vulnerability.","detection":"Monitor for HTTP GET requests to /wp-content/plugins/google-mp3-audio-player/direct_download.php with suspicious path traversal patterns in the 'file' parameter, particularly those containing '../' sequences that attempt to access wp-config.php or other sensitive files.","tags":["file-read","path-traversal","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:02:33.432Z"}}