CVE-2024-10803 - CVE House

Back to Database

Status published High CVE-2024-10803

MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/Download

7.5 CVSS

Vulnerability Description

The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Please note the vendor released the patched version as the same version as the affected version.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10803

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Tonn

References

More from FWDesign

View All →

WordPress Ultimate Video Player Plugin <= 10.1 - Broken Access Control Vulnerability

WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) Vulnerability

WordPress Easy Video Player Wordpress & WooCommerce plugin <= 10.0 - Arbitrary File Download Vulnerability

Ultimate Video Player <= 10.0 - Unauthenticated Arbitrary File Download

Affected Vendor

FWDesign

View all reports →

Affected Software

MP3 Sticky Player

Vulnerable Versions:

0

Timeline

Official Publish: November 23rd, 2024

Last Modified: April 8th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation