CVE-2025-8559: WordPress Music Player Path Traversal Flaw

CVE-2025-8559 Overview

The All in One Music Player plugin for WordPress contains a path traversal vulnerability in the theme parameter. The flaw affects all versions up to and including 1.3.1. Authenticated attackers with Contributor-level access or above can read arbitrary files on the underlying server. Successful exploitation exposes sensitive files such as configuration data, credentials, and application source code.

The issue is tracked as CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Wordfence published the vulnerability record on September 30, 2025.

Critical Impact
Contributor-level WordPress users can read the contents of any file readable by the web server process, including wp-config.php and other secrets.

Affected Products

All in One Music Player plugin for WordPress, versions ≤ 1.3.1
WordPress sites permitting Contributor-level (or higher) account registration
Multisite deployments running the vulnerable plugin

Discovery Timeline

2025-09-30 - CVE-2025-8559 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8559

Vulnerability Analysis

The All in One Music Player plugin exposes functionality that renders theme templates based on a user-supplied theme parameter. The plugin passes this parameter into a file inclusion or read operation without normalizing the path or restricting it to an allowlisted directory.

An authenticated attacker can supply traversal sequences such as ../../../../ to escape the intended themes directory. The request then resolves to arbitrary locations on the server's filesystem. The plugin returns the contents of the referenced file to the requester.

Because the vulnerability affects confidentiality only, integrity and availability remain intact. However, disclosed content frequently enables follow-on attacks including credential theft and privilege escalation.

Root Cause

The root cause is missing input validation on the theme parameter within the plugin's request handler in src/Plugin.php. The code accepts user-controlled path segments and passes them to a filesystem read routine without canonicalization or directory containment checks.

Attack Vector

Exploitation requires an authenticated session with Contributor privileges or higher. WordPress installations that allow open user registration with Contributor default roles increase exposure. The attacker submits a crafted HTTP request containing traversal sequences in the theme parameter and receives file contents in the response.

No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical details.

Detection Methods for CVE-2025-8559

Indicators of Compromise

HTTP requests to plugin endpoints containing theme= parameters with ../ or URL-encoded %2e%2e%2f sequences
Web server access log entries showing successful 200 OK responses to requests targeting the plugin with unusual theme values
Outbound activity or configuration changes originating from Contributor-tier accounts shortly after suspicious plugin requests

Detection Strategies

Inspect WordPress access logs for the plugin's request handlers with anomalous theme parameter values
Deploy web application firewall rules that block path traversal payloads targeting WordPress plugin routes
Correlate low-privilege user logins with subsequent requests reading system paths such as /etc/passwd or wp-config.php

Monitoring Recommendations

Alert on any Contributor-role account issuing requests to plugin endpoints outside normal editorial workflows
Monitor file access patterns on the web server for reads of sensitive files by the PHP process from HTTP request contexts
Track newly created Contributor-level accounts and correlate their activity with plugin-related HTTP traffic

How to Mitigate CVE-2025-8559

Immediate Actions Required

Deactivate and remove the All in One Music Player plugin if a patched version is not yet installed
Audit all Contributor-level and higher accounts and revoke unnecessary access
Rotate WordPress secrets, database credentials, and any keys stored in wp-config.php if compromise is suspected
Restrict plugin request endpoints at the web application firewall until remediation is verified

Patch Information

As of the last NVD update on 2026-06-17, all versions up to and including 1.3.1 are affected. Consult the WordPress plugin developer page for the latest release status and apply any vendor-supplied update that addresses the theme parameter handling.

Workarounds

Disable user registration or set the default role to Subscriber to reduce the pool of Contributor-eligible accounts
Apply a web application firewall rule blocking traversal patterns (../, %2e%2e%2f, ..%5c) against plugin endpoints
Enforce filesystem permissions so the PHP process cannot read files outside the web root, including operating-system credential stores

bash

# Example ModSecurity rule blocking traversal in the theme parameter
SecRule ARGS:theme "@rx (\.\./|%2e%2e%2f|\.\.\\)" \
    "id:1008559,phase:2,deny,status:403,\
    msg:'CVE-2025-8559 path traversal attempt in theme parameter'"