Description The MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin for WordPress is vulnerable to arbitrary file downloads due to insufficient file validation on the load_lyrics_ajax_callback() function in all versions up to, and including, 4.10.1. This makes it possible for unauthenticated attackers to download arbitrary files such as wp-config.php.
CPE | Name | Operator | Version |
---|---|---|---|
eq | 5.0 |