VulnSocial

CVE-2026-115497

LOWCVSS 7.5 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • Donweb Media@DonwebMedia

    Con solo comprar algo barato en una tienda con Music Store, alguien podría leer archivos de tu servidor. Así de grave es el CVE-2026-115497. Te contamos cómo parchearlo ya: https://seguridadenwordpress.com/cve-2026-115497-music-store-path-traversal/ #WordPress #MusicStore

    0000015
    9 followersView on X

Explore more

Back to dashboard