vulnerability

WordPress Plugin: fwdmsp: CVE-2024-10803: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:C/I:N/A:N)

Published

Nov 22, 2024

Added

May 15, 2025

Modified

Apr 29, 2026

Description

The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Please note the vendor released the patched version as the same version as the affected version.

Solution

fwdmsp-plugin-cve-2024-10803

References

https://www.cve.org/CVERecord?id=CVE-2024-10803
https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcd4675-e930-44d9-8278-c4c9e877656a?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33461
CVE-2024-10803
https://attackerkb.com/topics/CVE-2024-10803
CWE-22
EUVD-EUVD-2024-33461

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report