CVE-2014-125130
Received Received - Intake

Arbitrary File Read in Google MP3 Audio Player WordPress Plugin

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-03
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2014-125130
EUVD
EUVD-2014-9822

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
codeart google_mp3_audio_player to 1.0.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated arbitrary file read flaw in the CodeArt Google MP3 Audio Player WordPress plugin versions up to 1.0.11. Attackers can exploit it by sending a crafted HTTP request to direct_download.php with a path-traversal payload in the file parameter, such as ../../wp-config.php. This allows them to download sensitive files like WordPress configuration files containing database credentials and secret keys without authentication.

Detection Guidance

To detect this vulnerability, check if the WordPress plugin 'CodeArt Google MP3 Audio Player' version 1.0.11 or below is installed. Test for the flaw by sending a crafted HTTP request to the vulnerable path with a path-traversal payload, such as accessing /wp-content/plugins/google-mp3-audio-player/direct_download.php?file=../../wp-config.php. If the server responds with the contents of wp-config.php, the system is vulnerable.

  • Use a web vulnerability scanner like Nuclei with the template for this CVE to automate detection.
Impact Analysis

Exploitation can lead to full site compromise. Attackers can steal database credentials and secret keys from wp-config.php, potentially gaining control over the WordPress site. This could result in unauthorized data access, website defacement, or further attacks against users or connected systems.

Compliance Impact

This vulnerability allows unauthenticated attackers to read sensitive files like wp-config.php, exposing database credentials and secret keys. Such exposure could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately update the 'CodeArt Google MP3 Audio Player' plugin to version 1.0.12 or later, as this patch addresses the vulnerability. If updating is not possible, disable or remove the plugin entirely to prevent exploitation.

  • Monitor network traffic for suspicious requests targeting the vulnerable plugin paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2014-125130. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart