Directory Traversal Vulnerability in StoreEngine Plugin by WordPress
CVE-2026-15056

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Storeengine — Complete Ecommerce Solution With Memberships, Licensing, Affiliates & More
Vendor
CVE Published:
16 August 2026

What is CVE-2026-15056?

The StoreEngine plugin, designed for eCommerce solutions on WordPress, is susceptible to a directory traversal vulnerability in versions up to 2.1.1. The issue arises from the parse_file_path function, which permits authenticated attackers with vendor-level access to read server-side files arbitrarily. This flaw can potentially expose sensitive information stored on the server, posing a significant security risk to websites utilizing this plugin.

Affected Version(s)

StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More 0 <= 2.1.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/storeengine/ta...
https://plugins.trac.wordpress.org/browser/storeengine/ta...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zickzick2
.