The HB Audio Gallery Lite plugin contains a path traversal flaw (CWE‑22) in its audio‑download.php endpoint that permits an attacker to supply a malicious file_path parameter and retrieve any file located on the server, including sensitive configuration files such as wp‑config.php. This vulnerability is explicitly stated to allow arbitrary file disclosure without requiring authentication. The attack is carried out by sending a crafted GET request containing directory traversal sequences to the audio‑download.php script.

WordPress sites that have installed the HB Audio Gallery Lite plugin by Husain and are running version 1.0.0 are affected. The description does not claim that earlier releases are vulnerable, so only this version is confirmed as having the flaw.

The CVSS score of 8.7 describes a high‑severity condition that compromises confidentiality. The EPSS score is not available, so the current probability of exploitation cannot be quantified; however, the exploit path—simple URL manipulation—indicates it can be triggered with minimal effort. The flaw is not listed in the CISA KEV catalog, suggesting no known confirmed exploitation at this time, but the lack of authentication requirement means every visitor to the affected site could potentially use the path traversal vector to read arbitrary files.