{"id":"CVE-2026-115497","kind":"vulnerability","aliases":["CVE-2026-115497"],"related":[],"title":"WordPress Music Store plugin: directory traversal lets attackers read server files","description":"The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.","summary":"The Music Store WordPress eCommerce plugin, in all versions up to and including 1.4.7, fails to restrict the 'f' parameter, allowing directory traversal. An unauthenticated attacker who holds a valid purchase_id token can read arbitrary files on the server, which may include sensitive configuration data.","severity":"high","cvss":7.5,"epss":0.0095,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-version-above-1.4.7"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available\n- Confirm whether the plugin is active on the site\n- Plugin slug and exact file path are unknown from the sources","fix":"- Update the Music Store plugin to a version later than `1.4.7` once a patched release is published (the fixed version is unknown from the sources)\n- Until patched, deactivate the plugin if the store is not in use","status":"open","published_at":"2026-10-23T05:17:15+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:15:00+00:00","updated_at":"2026-10-25T03:15:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:15:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Music Store plugin to a version later than `1.4.7` once a patched release is published (the fixed version is unknown from the sources)\n- Until patched, deactivate the plugin if the store is not in use","reach":"internet","title":"WordPress Music Store plugin: directory traversal lets attackers read server files","impact":"medium","summary":"The Music Store WordPress eCommerce plugin, in all versions up to and including 1.4.7, fails to restrict the 'f' parameter, allowing directory traversal. An unauthenticated attacker who holds a valid purchase_id token can read arbitrary files on the server, which may include sensitive configuration data.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","ecommerce","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker reads arbitrary server files, including secrets","analyst_note":"Confirm the patched plugin version and plugin slug from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115497 or the plugin's WordPress.org changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available\n- Confirm whether the plugin is active on the site\n- Plugin slug and exact file path are unknown from the sources","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-1.4.7"],"who_is_affected":"Sites running the Music Store WordPress eCommerce plugin version 1.4.7 or earlier are exposed. The attacker needs a valid purchase_id token, which the sources say any user can get with a low-cost purchase or a shared download link. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":3416,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115497':14A,17A '-2026':13A,16A '1.4.7':40B,93C 'allow':47B 'arbitrari':62B,111C 'attack':8A,52B,105C 'configur':71B 'contain':118C 'content':109C 'cost':139C 'cve':12A,15A 'data':72B 'directori':5A,48B,84C 'download':145C 'ecommerc':18B,31B,77C 'exploit':121C 'f':45B,96C 'fail':41B 'file':11A,63B,112C 'hold':54B 'host':22B 'id':58B,126C 'includ':39B,69B,92C 'inform':120C 'let':7A 'link':146C 'low':138C 'low-cost':137C 'make':100C,134C 'may':68B 'music':2A,28B,74C 'obtain':132C 'packag':19B 'paramet':46B,97C,98C 'plugin':4A,26B,32B,78C 'possibl':102C 'purchas':57B,125C,140C 'read':9A,61B,107C 'receiv':142C 'requir':122C 'restrict':43B 'self':21B 'self-host':20B 'sensit':70B,119C 'server':10A,66B,115C 'share':144C 'singl':136C 'store':3A,29B,75C 'token':59B,127C 'travers':6A,49B,85C 'unauthent':51B,104C 'user':130C 'valid':56B,124C 'version':35B,88C 'via':94C 'vulner':82C 'wordpress':1A,23B,25B,30B,76C,80C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Music Store WordPress eCommerce plugin version 1.4.7 or earlier are exposed. The attacker needs a valid purchase_id token, which the sources say any user can get with a low-cost purchase or a shared download link. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T05:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115497","severity":null,"published_at":"2026-10-23T05:17:15+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115497","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115497","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}