Path Traversal Vulnerability in StoreEngine WordPress eCommerce Plugin
CVE-2025-9215
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2025
What is CVE-2025-9215?
The StoreEngine plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access or higher to exploit the file_download() function. This weakness enables attackers to traverse directories and read arbitrary files on the server, potentially exposing sensitive data. All versions of the plugin up to and including 1.5.0 are affected, creating a significant risk for sites using this eCommerce solution.
Affected Version(s)
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More * <= 1.5.0