---
id: "CVE-2026-115497"
kind: "vulnerability"
aliases: ["CVE-2026-115497"]
title: "WordPress Music Store plugin: directory traversal lets attackers read server files"
severity: "high"
cvss: 7.5
epss: 0.0095
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-version-above-1.4.7"]
published_at: "2026-10-23T05:17:15+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:15:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115497", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115497", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# WordPress Music Store plugin: directory traversal lets attackers read server files

The Music Store WordPress eCommerce plugin, in all versions up to and including 1.4.7, fails to restrict the 'f' parameter, allowing directory traversal. An unauthenticated attacker who holds a valid purchase_id token can read arbitrary files on the server, which may include sensitive configuration data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available
- Confirm whether the plugin is active on the site
- Plugin slug and exact file path are unknown from the sources

## Fix

- Update the Music Store plugin to a version later than `1.4.7` once a patched release is published (the fixed version is unknown from the sources)
- Until patched, deactivate the plugin if the store is not in use

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115497
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115497

## From the sources

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_