Description
WordPress Plugin MP3-jPlayer is prone to a local file disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability could allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application; this may aid in further attacks. WordPress Plugin MP3-jPlayer version 2.3 is vulnerable; other versions may also be affected.
Remediation
Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available
References
http://k3dsec.blogspot.ro/2015/03/wordpress-plugin-mp3-jplayer-v23-local.html
http://packetstormsecurity.com/files/130956/WordPress-MP3-Jplayer-2.1-Local-File-Disclosure.html
Related Vulnerabilities
Moodle Insertion of Sensitive Information Into Sent Data Vulnerability (CVE-2025-67857)
MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-9411)
WordPress Plugin Social Sharing-Sassy Social Share PHP Object Injection (3.3.23)
Oracle Application Server CVE-2009-0996 Vulnerability (CVE-2009-0996)