Description
WordPress的Mayosis Core插件存在任意文件读取漏洞，影响5.4.1及之前所有版本。该漏洞位于library/wave-audio/peaks/remote_dl.php文件中，允许未经身份验证的攻击者读取服务器上的任意文件内容，可能导致包含敏感信息的文件泄露。
WordPress Plugin Mayosis Core /wp-content/plugins/mayosis-core/library/wave-audio/peaks/remote_dl.php 文件读取漏洞 （CVE-2025-1565）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-1565
https://www.sentinelone.com/vulnerability-database/cve-2025-1565/
https://access.redhat.com/security/cve/cve-2025-1565
https://www.ameeba.com/blog/cve-2025-1565-arbitrary-file-read-vulnerability-in-mayosis-core-plugin-for-wordpress/
https://hackhalt.com/threat/cve-2025-1565/
https://cve.enginsight.com/2025/1565/index.html
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mayosis-core
https://patchstack.com/database/wordpress/plugin/mayosis-core/vulnerability/wordpress-mayosis-core-plugin-5-4-1-unauthenticated-arbitrary-file-read-vulnerability
https://cve.imfht.com/detail/CVE-2025-1565