Live › vulnerability › CVE-2026-115497
Go to dashboardThe Music Store WordPress eCommerce plugin, in all versions up to and including 1.4.7, fails to restrict the 'f' parameter, allowing directory traversal. An unauthenticated attacker who holds a valid purchase_id token can read arbitrary files on the server, which may include sensitive configuration data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Music Store WordPress eCommerce plugin version 1.4.7 or earlier are exposed. The attacker needs a valid purchase_id token, which the sources say any user can get with a low-cost purchase or a shared download link. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version if WP-CLI is available1.4.7 once a patched release is published (the fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
This page as .md · .json · in your agent: get_signal("CVE-2026-115497")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.