CVE Alert: CVE-2014-125130 – Damjan

CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

**Risk verdict:** Treat this as an urgent, priority-1 exposure: the vulnerability is listed as known exploited, although current exploitation prevalence is not provided.

**Why this matters:** A successful read can expose configuration secrets, enabling attackers to access the site’s database or forge trusted sessions. The direct impact is confidentiality loss, but stolen credentials can lead to broader site compromise, data theft, or use of the site to target visitors.

**Most likely attack path:** The endpoint is reachable over the network and requires no account, user action, or special conditions, making opportunistic scanning and exploitation realistic. The issue does not itself cross a security boundary, but recovered credentials may enable follow-on access to the database or hosting environment. Confirm whether the vulnerable component remains installed and reachable.

**Who is most exposed:** Public WordPress sites with the audio-player plugin still active are the primary concern, particularly neglected or legacy installations.

web access logs for requests to `direct_download.php` with traversal sequences in the `file` parameter.

Check response records for unexpected downloads or disclosures of configuration files.

Review WordPress, database, and hosting logs for suspicious access following matching requests.

Rotate exposed credentials and investigate their use if exploitation is suspected.

Mitigation and prioritisation:

Remove or disable the affected plugin; do not assume a safe upgrade exists, as support status is uncertain.

If removal cannot be immediate, block the endpoint at the WAF or web server and restrict access to the plugin path.

Rotate database credentials and secret keys after suspected exposure; assess for persistence and unauthorised changes.

Validate exposure through asset inventory; EPSS and SSVC data are not supplied, so risk beyond known exploitation remains uncertain.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.