CVE-2025-9215: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in kodezen StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More
The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the file_download() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
AI Analysis
Technical Summary
The StoreEngine WordPress plugin (versions up to 1.5.0) contains a path traversal vulnerability (CWE-22) in its file_download() function. Authenticated attackers with at least Subscriber privileges can exploit this flaw to read arbitrary files on the server, potentially accessing sensitive data. The vulnerability is network exploitable with low attack complexity and no user interaction required. Integrity and availability are not impacted, but confidentiality is highly impacted.
Potential Impact
An attacker with Subscriber-level access can read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information such as configuration files, credentials, or other private data. The vulnerability does not affect system integrity or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently listed, users should monitor the vendor's communications for updates. In the meantime, restrict Subscriber-level access to trusted users only and consider disabling or limiting the use of the file_download() function if possible.
CVE-2025-9215: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in kodezen StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More
Description
The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the file_download() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The StoreEngine WordPress plugin (versions up to 1.5.0) contains a path traversal vulnerability (CWE-22) in its file_download() function. Authenticated attackers with at least Subscriber privileges can exploit this flaw to read arbitrary files on the server, potentially accessing sensitive data. The vulnerability is network exploitable with low attack complexity and no user interaction required. Integrity and availability are not impacted, but confidentiality is highly impacted.
Potential Impact
An attacker with Subscriber-level access can read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information such as configuration files, credentials, or other private data. The vulnerability does not affect system integrity or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently listed, users should monitor the vendor's communications for updates. In the meantime, restrict Subscriber-level access to trusted users only and consider disabling or limiting the use of the file_download() function if possible.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-08-19T20:03:22.388Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 68cab09db62c8e2e63b2468e
Added to database: 9/17/2025, 12:59:09 PM
Last enriched: 4/9/2026, 9:49:27 PM
Last updated: 5/10/2026, 8:56:44 AM
Views: 187
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.