Arbitrary File Read Vulnerability in CLEVER HTML5 Radio Player Plugin for WordPress
CVE-2025-3103

7.5HIGH

Key Information:

Vendor
WordPress
Status
Clever - Html5 Radio Player With History - Shoutcast And Icecast - Elementor Widget Addon
Vendor
CVE Published:
19 April 2025

Summary

The CLEVER HTML5 Radio Player With History plugin for WordPress is susceptible to arbitrary file read vulnerabilities due to inadequate file path validation in the 'history.php' file. This flaw, present in all versions up to and including 2.4, allows unauthorized attackers to access any file on the server hosting the affected site, potentially exposing sensitive information such as database credentials. A partial patch has been implemented in version 2.4, yet the issue still merits serious attention to ensure comprehensive protection against data breaches.

Affected Version(s)

CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon * <= 2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/clever-html5-radio-player-wit...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (from VCI - VNPT Cyber Immunity)
.