CVE-2024-10803CWE-22

MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/Download

High · published November 23, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
60.7
In the wild
Unconfirmed
What it is

The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Please note the vendor released the patched version as the same version as the affected version.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00943 · 60.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-11-23T07:38Z
EPSS history
Timeline
  • 23 NOV 07:38Z
    MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/Download
    cvelistv5