CVE-2026-115497
CVE-2026-115497 · Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
CVSS 7.5 · High · EPSS 0.9%
- Published
- Updated
Affected products and versions
music store – wordpress ecommerce
- Versions
- ≥ 0, ≤ 1.4.7: Affected (semver)
No fix published
Original sources
- https://www.wordfence.com/threat-intel/vulnerabilities/id/31e41b8c-f83f-4cd7-a30f-deac6154c7e3?source=cve
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L378
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L371
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L400
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/music-store.php#L312
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.8
- https://nvd.nist.gov/vuln/detail/CVE-2026-115497