HIGH 8.7 NVD
CVE-2014-125130
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpr
- https://patchstack.com/database/wordpress/plugin/google-mp3-audio-player/vulnerability/wor
- https://www.exploit-db.com/exploits/35460
- https://www.vulncheck.com/advisories/codeart-google-mp3-audio-player-arbitrary-file-read-v
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-02 via NVD.
vulnfeed aggregates 10027 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.