CVE-2026-115497 in Music Store Plugin
Summary
by MITRE • 10/23/2026
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The Music Store plugin is a widely utilized eCommerce solution for WordPress that facilitates digital product sales and downloads. A critical security flaw has been identified within versions up to 1.4.7, specifically involving the handling of file retrieval requests through the f parameter. This vulnerability constitutes an insecure direct object reference combined with directory traversal capabilities, allowing attackers to manipulate input parameters to access files outside the intended scope. The core technical issue stems from insufficient validation and sanitization of user-supplied data when processing download or file access requests. By injecting path traversal sequences such as dot-dot-slash into the f parameter, an attacker can redirect the server's file read operation toward arbitrary locations on the filesystem rather than restricting it to the designated plugin directory or uploaded media library.
The operational impact of this vulnerability is severe because it enables unauthenticated information disclosure. Although exploitation requires a valid purchase_id token, obtaining such a token does not require high-level privileges or complex authentication bypasses. An attacker can easily acquire a legitimate token by performing a single low-cost transaction on the site or by receiving a shared download link from any existing customer. This significantly lowers the barrier to entry for malicious actors, as it transforms what might otherwise be an authenticated-only vulnerability into one that is accessible to virtually anyone with internet access and minimal resources. Once exploited, the attacker can read sensitive files residing on the server, including configuration files containing database credentials, environment variables, source code of other plugins or themes, and potentially system-level configurations depending on file permissions.
This type of flaw aligns directly with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to properly neutralize special elements that could be used to traverse directories. Furthermore, it relates to CWE-918 in contexts where server-side request forgery or local file inclusion principles apply if the traversal leads to executing code via included files. In terms of offensive security frameworks like MITRE ATT&CK, this behavior is consistent with techniques found under Tactic: Discovery and Subtechnique: File and Directory Discovery (T1083), as well as potential data exfiltration pathways depending on how the retrieved information is utilized in subsequent attack stages. The lack of strict input validation allows for arbitrary file reads which can serve as a foothold for more advanced attacks such as remote code execution if sensitive files containing secrets are exposed and leveraged to compromise backend services or database integrity.
Mitigation strategies must prioritize immediate patching by upgrading the Music Store plugin to version 1.4.8 or later, where this specific input validation flaw has been addressed. In addition to updating software, administrators should implement strict file permission policies on their WordPress installations, ensuring that web server processes do not have read access to sensitive configuration files such as wp-config.php unless absolutely necessary for application functionality. Web Application Firewalls can be configured with rulesets designed to detect and block common directory traversal patterns in URL parameters, providing an additional layer of defense against exploitation attempts while patches are being deployed. Regular security audits and penetration testing should also be conducted to identify similar input handling weaknesses across other plugins and themes installed on the WordPress instance, ensuring a holistic approach to application security hygiene.