CVE-2026-115497: Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchaseid token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it if they have a valid purchase_id token. They can obtain one through a single low-cost purchase or by receiving a shared download link.
Are installations running version 1.4.7 affected?
Yes. The issue affects all Music Store versions up to and including 1.4.7.
What can an attacker access if exploitation succeeds?
An attacker can read arbitrary files on the server through directory traversal in the f parameter. Exposed files may contain sensitive information.