The All in One Music Player plugin for WordPress suffers from a CWE-22 path traversal vulnerability in all versions up to and including 1.3.1. An authenticated attacker with at least Contributor privileges can manipulate the 'theme' parameter to traverse directories and read arbitrary files on the server. This vulnerability allows unauthorized disclosure of potentially sensitive server files. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and limited privileges required. No patch or remediation has been provided by the vendor as of the published date.

Successful exploitation allows an authenticated user with Contributor-level access or higher to read arbitrary files on the server, potentially exposing sensitive information. There is no impact on integrity or availability reported. This could lead to information disclosure that may aid further attacks or compromise privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the 'theme' parameter in the plugin. Consider disabling or removing the plugin if possible to reduce risk.