Directory Traversal Vulnerability in Music Store WordPress eCommerce Plugin

CVE-2026-115497

What is CVE-2026-115497?

The Music Store eCommerce plugin for WordPress is affected by a Directory Traversal vulnerability, which allows unauthenticated attackers to read arbitrary files from the server. This occurs through the 'f' parameter. An attacker needs a valid purchase_id token, which can easily be obtained with minimal financial investment or by sharing a download link. The risk is heightened as the contents of these files may include sensitive information, leading to potential data breaches.

References