Directory Traversal Vulnerability in SE HTML5 Album Audio Player Plugin for WordPress

CVE-2015-4414

Summary

The SE HTML5 Album Audio Player plugin for WordPress contains a directory traversal vulnerability that allows remote attackers to exploit the 'download_audio.php' file. By manipulating the file parameter with '../' sequences, an attacker could gain unauthorized access to arbitrary files on the server. This can lead to sensitive data exposure, making the application and server environment vulnerable to further attacks. Users of this plugin should upgrade to the latest version to mitigate this risk.

References