Wordpress Codeart Google Mp3 Player Plugin File Disclosure Download

Back patchstack.com

Wordpress Codeart Google Mp3 Player Plugin File Disclosure Download

patchstack.com • October 3, 2026

Share: View original

As immediate action, update the affected plugin. If you're unable to do so, ask your hosting provider or web developer for help.

Arbitrary File Download

Attackers can download private server files and steal secrets like passwords or keys.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.

This security issue has a low severity impact and is unlikely to be exploited.

Update to version 1.0.12 or later.

Update to version 1.0.12 or later to resolve the vulnerability. Patchstack users can turn on auto-update for vulnerable plugins only.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Urgent CVE-2014-125130: File Disclosure in CodeArt Google MP3 Player Plugin The CodeArt Google MP3 Audio Player plugin for WordPress, up to version 1.0.11, has an unauthenticated arbitrary file read vulnerability (CVE-2014-125130), allowing attackers to exploit path traversal in direct_download.php. This vulnerability was first observed being exploited on October 19, 2023, enabling unauthorized access to sensitive files like wp-config.php, which can lead to full site compromise. Public WordPress sites using this plugin are at the highest risk, especially those that are outdated or neglected. Immediate action is required to mitigate risks, including updating to version 1.0.12 or later, or disabling the plugin entirely. The vulnerability has a CVSS score of 8.7, indicating high severity, and is currently listed as. Security professionals should audit their logs for suspicious access and rotate any exposed credentials. 1 sources 69

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-200 - Exposure of Sensitive Information

Platforms (1)