Google MP3 Audio Player plugin: Unauthenticated arbitrary file read

Summary

The WordPress plugin Google MP3 Audio Player (google-mp3-audio-player) up to version 1.0.11 contains an unauthenticated path traversal flaw in direct_download.php. A remote attacker can read arbitrary server files, such as wp-config.php, by manipulating the file parameter. Exposed database credentials and secret keys can lead to full compromise of the WordPress site. Public exploit code exists, and one source reports exploitation in the wild since 2023, although this is contested.

Affected

• Google MP3 Audio Player WordPress plugin (google-mp3-audio-player), versions 0 to 1.0.11
• Vulnerable endpoint: direct_download.php, parameter file

Fixed in

• Version 1.0.12 according to Patchstack (not confirmed by a vendor advisory or changelog; unverified)
• The plugin appears to be no longer maintained; confirm on WordPress.org

Workaround

• No vendor workaround documented.
• If an update is not possible, deactivate and remove the plugin (recommendation, not a vendor one).
• No virtual patch rules found on Patchstack.

Exploitation

• Public proof of concept: Exploit-DB 35460 (December 2014).
• Nuclei detection template available.
• Exploitation in the wild reported by Shadowserver from 2023-10-19 (VulDB and CVE description); not verified on Shadowserver's site.
• Not confirmed in CISA KEV.
• Attack requires no authentication.

Our recommendation

• Check whether the plugin is installed on any WordPress site (plugin list, file path wp-content/plugins/google-mp3-audio-player).
• Remove the plugin if it is not needed; if it is needed, update to 1.0.12 or later after verifying the version.
• Rotate database credentials and WordPress salts/keys on any site that was exposed.
• Review web server logs for requests to direct_download.php containing ../ sequences.
• Verify the CVSS and fix information against NVD before relying on it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Exploit-DB 35460 www.exploit-db.com
• Nuclei template wp-googlemp3-lfi github.com
• VulnCheck advisory www.vulncheck.com
• VulDB CVE-2014-125130 vuldb.com
• Alert Logic advisory support.alertlogic.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:46.