CVE-2014-125130
CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
| CWE | CWE-22 |
| Vendor | damjan |
| Product | codeart google mp3 audio player |
| Published | Oct 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for damjan codeart google mp3 audio player
Be the first to know when new high vulnerabilities affecting damjan codeart google mp3 audio player are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Damjan / CodeArt Google MP3 Audio Player
0 ≤ 1.0.11
References
exploit-db.com: https://www.exploit-db.com/exploits/35460 patchstack.com: https://patchstack.com/database/wordpress/plugin/google-mp3-audio-player/vulnerability/wordpress-codeart-google-mp3-player-plugin-file-disclosure-download github.com: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-googlemp3-lfi.yaml vulncheck.com: https://www.vulncheck.com/advisories/codeart-google-mp3-audio-player-arbitrary-file-read-via-direct-download-php
Credits
QK14 Team 🔍 The Shadowserver Foundation