CVE-2014-125130 in Google MP3 Audio Player Plugin
Summary
by MITRE • 10/02/2026
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The CodeArt Google MP3 Audio Player plugin for WordPress, specifically versions up through 1.0.11, contains a critical unauthenticated arbitrary file read vulnerability that poses a severe risk to website integrity and data confidentiality. This flaw resides within the direct_download.php script component of the plugin, where input validation mechanisms are insufficiently implemented to sanitize user-supplied parameters. The core technical deficiency involves the failure to properly restrict or validate the path provided in the file parameter before it is processed by the underlying file system operations. Because this endpoint does not require authentication, any remote attacker on the internet can interact with this functionality directly without needing valid credentials for the WordPress administration panel or even a user account on the site itself.
The exploitation mechanism relies on standard directory traversal techniques using path-traversal payloads such as ../../wp-config.php to bypass intended access controls and navigate up the server's directory structure from the plugin's installation location. By manipulating the file parameter, an attacker can request files that are normally protected by web server configuration or WordPress core security measures. The most critical target in this scenario is typically the wp-config.php file, which serves as the central configuration file for a WordPress installation. This file contains sensitive information including database hostnames, usernames, passwords, and unique authentication keys and salts. Accessing these credentials allows an attacker to gain direct access to the underlying MySQL or MariaDB database, bypassing all application-level security controls entirely.
The operational impact of this vulnerability is profound and often leads to a complete compromise of the affected web server environment. Once an attacker retrieves the wp-config.php file, they can extract database credentials to exfiltrate user data, customer information, and other content stored in the WordPress database. Furthermore, with knowledge of the secret keys and salts, attackers may be able to forge authentication cookies for existing users or administrators, effectively hijacking active sessions without needing to crack passwords. In many server configurations, if the web server is misconfigured to allow PHP execution outside its intended directories or if file permissions are overly permissive, an attacker might even leverage this information to upload and execute malicious scripts, achieving remote code execution on the host system. This transforms a simple data leak into a full-scale infrastructure compromise.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. From the perspective of the MITRE ATT&CK framework, this exploitation technique maps to T1530 Data from Local System Retrieval and potentially T1078 Valid Accounts if session hijacking is performed using stolen keys. The Shadowserver Foundation observed active exploitation of this specific vulnerability in the wild starting on October 19, 2023, indicating that automated scanners and threat actors are actively targeting WordPress installations running vulnerable versions of this plugin. This real-world evidence underscores the urgency for immediate remediation as passive exposure is no longer theoretical but an ongoing operational reality for many organizations.
Mitigation strategies must focus on both immediate patching and broader security hygiene practices. The primary defense is to update the CodeArt Google MP3 Audio Player plugin to version 1.0.12 or later, where the developers have presumably implemented proper input validation and path canonicalization to prevent directory traversal attacks. If updating is not immediately feasible due to compatibility concerns, administrators should consider disabling the direct_download.php endpoint via web server configuration rules such as Apache mod_rewrite or Nginx deny directives until a patch can be applied. Additionally, organizations should audit their wp-config.php file permissions to ensure they are set to 400 or 600 and owned by the appropriate user, preventing read access even if traversal occurs. Implementing Web Application Firewalls with rules specifically targeting path-traversal patterns in query parameters can also provide a layer of defense against exploitation attempts while patching efforts are underway. Regular monitoring for unauthorized file modifications and database anomalies is recommended to detect any successful compromises early.