Arbitrary File Read Vulnerability in Mayosis Core Plugin for WordPress

CVE-2025-1565

What is CVE-2025-1565?

The Mayosis Core plugin for WordPress presents a vulnerability that allows unauthorized access to sensitive file content on the server. Through a specific PHP file located in library/wave-audio/peaks/remote_dl.php, an unauthenticated attacker can exploit this flaw to read contents from arbitrary files, potentially exposing sensitive information stored on the server. This vulnerability affects all versions up to and including 5.4.1 of the Mayosis Core plugin, highlighting the importance of keeping plugins up-to-date and regularly monitoring web applications for security issues.

References