CVE-2025-3103: WordPress Radio Player File Read Flaw

CVE-2025-3103 Overview

CVE-2025-3103 is an arbitrary file read vulnerability in the CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress. The flaw resides in the history.php file and stems from insufficient file path validation [CWE-73]. Unauthenticated attackers can read arbitrary files on the affected server over the network, including configuration files containing database credentials. All plugin versions up to and including 2.4 are affected, and the issue was only partially patched in version 2.4.

Critical Impact
Unauthenticated remote attackers can read sensitive files such as wp-config.php, exposing database credentials and secret keys.

Affected Products

CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon for WordPress
All versions up to and including 2.4
Version 2.4 (partial patch only)

Discovery Timeline

2025-04-19 - CVE-2025-3103 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3103

Vulnerability Analysis

The vulnerability is classified as External Control of File Name or Path [CWE-73]. The plugin's history.php endpoint accepts a file path parameter from incoming HTTP requests and passes it to file read operations without enforcing a safe base directory or sanitizing traversal sequences. Attackers send crafted requests containing relative path sequences such as ../ to escape the intended directory and read arbitrary files readable by the web server process.

Because the endpoint requires no authentication, exploitation requires only network reachability to the WordPress site. Successful exploitation typically targets wp-config.php, which stores database credentials, authentication keys, and salts. Disclosure of these secrets enables follow-on attacks including database compromise, session forgery, and full site takeover.

Root Cause

The root cause is missing validation of the file path argument processed by history.php. The plugin does not canonicalize the requested path, restrict it to an allow-listed directory, or reject directory traversal characters. Vendor release notes indicate the 2.4 update reduced but did not fully eliminate the unsafe path handling.

Attack Vector

Exploitation occurs entirely over the network with no user interaction and no privileges. An attacker issues a single HTTP request to the vulnerable history.php endpoint, supplying a traversal payload that resolves to a sensitive file on the underlying filesystem. The server returns the file contents in the HTTP response. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-3103

Indicators of Compromise

HTTP requests to history.php containing directory traversal sequences such as ../, ..%2f, or encoded variants
Access log entries referencing sensitive filenames like wp-config.php, .env, or /etc/passwd in query parameters
Outbound database connections from unexpected source IPs following suspicious requests to the plugin endpoint
Unexpected administrator logins or password resets after exposure of WordPress secret keys

Detection Strategies

Inspect web server and WordPress access logs for requests targeting the plugin's history.php with file path parameters
Deploy web application firewall rules that block directory traversal patterns against WordPress plugin paths
Alert on responses to history.php with content lengths or content types inconsistent with normal radio history data
Correlate plugin endpoint access with subsequent authentication anomalies in WordPress audit logs

Monitoring Recommendations

Continuously monitor file integrity for wp-config.php and other secrets to detect post-exploitation modification
Track unauthenticated requests volume to /wp-content/plugins/ paths and flag traversal-shaped parameters
Rotate and monitor usage of database credentials and WordPress salts if exposure is suspected
Enable centralized logging of WordPress and web server activity for retrospective hunts against this CVE

How to Mitigate CVE-2025-3103

Immediate Actions Required

Update the CLEVER HTML5 Radio Player plugin to the latest available version beyond 2.4, since 2.4 contains only a partial fix
Audit wp-config.php exposure assumptions: rotate database passwords, AUTH_KEY, and related salts if the plugin was internet-exposed
Review web server access logs for prior exploitation attempts referencing history.php and traversal payloads
Restrict access to the plugin directory at the web server or WAF layer until a complete fix is verified

Patch Information

The vendor partially patched the issue in version 2.4. Administrators should consult the Codecanyon Plugin Release Log for the most current release and apply any subsequent updates that fully remediate the path validation logic. If a complete fix is not yet available, deactivate and remove the plugin.

Workarounds

Deactivate and uninstall the plugin until a fully patched version is released
Add WAF or ModSecurity rules that block traversal sequences in requests to history.php
Use filesystem permissions to ensure the web server user cannot read sensitive files outside the WordPress webroot where feasible
Place the WordPress site behind authentication or IP allow-listing if the plugin must remain active

bash

# Example WAF rule blocking traversal against the vulnerable endpoint
SecRule REQUEST_URI "@contains history.php" \
    "chain,deny,status:403,id:1003103,msg:'CVE-2025-3103 traversal attempt'"
    SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.%2f|wp-config\.php)" "t:lowercase,t:urlDecodeUni"