Executive brief
HB Audio Gallery Lite is a WordPress plugin used to display and manage audio playlists on websites. A security flaw allows unauthorized individuals to download any file from the web server, including sensitive configuration files that contain database passwords and site keys. This could lead to a full site takeover or the exposure of private customer and administrative data.
Technical details
A path traversal vulnerability exists in the 'audio-download.php' endpoint of the HB Audio Gallery Lite plugin version 1.0.0. The 'file_path' parameter is not properly sanitized before being used in file operations, allowing an unauthenticated remote attacker to use directory traversal sequences (e.g., ../../) to access files outside of the intended directory. By exploiting this, an attacker can download sensitive system files such as 'wp-config.php', which contains database credentials. The plugin was closed on the WordPress repository in March 2016 and is no longer available for download; users should migrate to a supported alternative.
Affected products
- Husain HB Audio Gallery Lite 1.0.0
Timeline
- 2016-03-22: disclosed: Vulnerability discovered and vendor informed; exploit published on Exploit-DB.
- 2016-03-26: other: Plugin closed on WordPress.org repository.
- 2026-06-15: advisory: CVE-2016-20081 published.