Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Music Store plugin lets anyone read any file

CVE-2026-115497 · published 13 days ago
Summary

The Music Store eCommerce plugin for WordPress allows anyone with a low-cost purchase token to retrieve any file from the server. This could expose confidential data such as passwords or business records. Update the plugin to the latest version or remove it until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
codepeople music store – wordpress ecommerce <= 1.4.7
Original advisory text
Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published23 Oct 2026
Updated4 Nov 2026
First seen23 Oct 2026
Sources
CVE-2026-115497 · NVD
CVE-2026-115497 · MITRE
Track software like this
Free during beta