CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Mayosis Core versions up to 5.4.1 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can craft requests to access files outside the intended directory, potentially exposing sensitive configuration files, database credentials, or other confidential data. No user interaction or special privileges are required to exploit this flaw.
What an attacker can do
Read arbitrary files from the server, including sensitive configuration and credential files.
Potential impact on your site
Sensitive files (config, database credentials, private keys) may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
