The HB Audio Gallery Lite plugin contains a path traversal flaw (CWE‑22) in its audio‑download.php endpoint that permits an attacker to supply a malicious file_path parameter and retrieve any file located on the server, including sensitive configuration files such as wp‑config.php. This vulnerability is explicitly stated to allow arbitrary file disclosure without requiring authentication. The attack is carried out by sending a crafted GET request containing directory traversal sequences to the audio‑download.php script.

WordPress sites that have installed the HB Audio Gallery Lite plugin by Husain and are running version 1.0.0 are affected. The description does not claim that earlier releases are vulnerable, so only this version is confirmed as having the flaw.

The CVSS score of 8.7 describes a high‑severity condition that compromises confidentiality. The EPSS score of 0.00641 indicates a very low but nonzero probability of exploitation; the exploit path—simple URL manipulation—still suggests it can be triggered with minimal effort. The flaw is not listed in the CISA KEV catalog, suggesting no known confirmed exploitation at this, but the of authentication requirement means every visitor to the affected site could potentially use the path traversal vector to read arbitrary files.