CVE-2014-125130 CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php
Unauthenticated attackers can read sensitive files like wp-config.php via path traversal in the Google MP3 Audio Player plugin, leading to site compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-125130?
CVE-2014-125130 is a high-severity path traversal vulnerability in Damjan CodeArt Google MP3 Audio Player, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Weakness: CWE-22
Which versions are affected by CVE-2014-125130?
How do I fix CVE-2014-125130?
No fix has been published for CVE-2014-125130 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2014-125130 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-125130 exists.
Sources
Also known as GHSA-jxrx-56g9-9j28.