A path traversal flaw exists in the All in One Music Player plugin for WordPress that is triggered through the "theme" parameter. The flaw allows an attacker who has authenticated access with Contributor or higher role to read arbitrary files stored on the server, potentially exposing sensitive data such as configuration files or user credentials. The weakness is a classic directory traversal issue (CWE-22).

The vulnerability affects all installations of the All in One Music Player plugin for WordPress with a version of 1.3.1 or earlier. The plugin is developed by the vendor sanzeeb3 and can be found under the product name "All in One Music Player".

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% shows that exploitation is considered unlikely. The flaw is not listed in the CISA KEV catalogue. An attacker must first be authenticated and possess at least Contributor level permissions, after which the path traversal can be abused by supplying crafted values to the theme parameter. The impact is confined to the attacker’s permissions, but can still lead to disclosure of sensitive files if the user has read access to them.