CVE-2024-10803

Deeper analysis

The MP3 Sticky Player plugin for WordPress is affected by a directory traversal vulnerability (CWE-22) present in all versions through 8.0. The flaw resides in the content/downloader.php component and permits an attacker to supply path traversal sequences that cause the application to read arbitrary files on the underlying server.

Unauthenticated remote attackers can exploit the issue over the network without any user interaction. Successful exploitation grants read access to sensitive files such as configuration data, credentials, or other restricted content, corresponding to the observed CVSS 7.5 rating that emphasizes high confidentiality impact with no integrity or availability effects.

The vendor published a patched release that carries the same version number as the vulnerable release, requiring administrators to verify the actual file contents or obtain the corrected package directly from the vendor site. The Wordfence advisory linked in the references provides additional technical detail on the affected endpoint and confirms the unauthenticated attack vector.

EPSS scores have remained low throughout the observation window, with a modest peak of 0.0546 that has since receded to 0.0408, indicating limited observed exploitation interest.