Description
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Published: 2026-10-02
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote File Read leading to credential disclosure and possible full site compromise
Action: Patch
AI Analysis

Impact

CodeArt Google MP3 Audio Player plugin for WordPress, version 1.0.11, contains an unauthenticated arbitrary file read flaw. Attackers can supply a path‑traversal payload in the file parameter of direct_download.php, for example ../../wp-config.php, to read any file on the server. The vulnerability can expose database credentials, secret keys and other sensitive data, enabling full compromise of the site.

Affected Systems

The flaw affects WordPress installations that have the CodeArt Google MP3 Audio Player plugin v1.0.11 or older deployed. The vulnerable component is direct_download.php located within the plugin directory. Any site that has left this file accessible to all users is at risk, regardless of the site's size or user role structure.

Risk and Exploitability

The vulnerability is scored CVSS 8.7, indicating high severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but corruption evidence was observed by the Shadowserver Foundation in October 2023. Because authentication is not required and the attack vector is remote via HTTP, exploitation is straightforward. Successful exploitation delivers arbitrary files, which directly leads to credential theft and complete site takeover.

Generated by OpenCVE AI on October 2, 2026 at 20:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the CodeArt Google MP3 Audio Player plugin to the latest version that addresses the path traversal flaw
  • If an upgrade is not possible, delete or block direct_download.php by removing the file or restricting its access with server configuration (e.g., .htaccess or web‑server rules)
  • Implement server‑side input sanitisation or a whitelist to prevent path‑traversal patterns in the file parameter

Generated by OpenCVE AI on October 2, 2026 at 20:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Damjan
Damjan codeart Google Mp3 Audio Player
Wordpress-extensions
Wordpress-extensions codeart Google Mp3 Audio Player
Vendors & Products Damjan
Damjan codeart Google Mp3 Audio Player
Wordpress-extensions
Wordpress-extensions codeart Google Mp3 Audio Player

Mon, 05 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Title CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Damjan Codeart Google Mp3 Audio Player
Wordpress-extensions Codeart Google Mp3 Audio Player
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-05T18:08:21.199Z

Reserved: 2026-10-02T16:48:26.482Z

Link: CVE-2014-125130

cve-icon Vulnrichment

Updated: 2026-10-05T18:07:37.850Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T19:16:37.440

Modified: 2026-10-06T16:08:43.180

Link: CVE-2014-125130

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T21:10:23Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')