CVE-2026-115497: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in codepeople Music Store – WordPress eCommerce

CVE-2026-115497 describes a directory traversal vulnerability in the Music Store – WordPress eCommerce plugin for WordPress. The flaw exists in all versions up to and including 1.4.7 and is exploitable via the 'f' parameter. An attacker who possesses a valid purchase_id token can leverage this vulnerability to read arbitrary files on the server, potentially exposing sensitive information. The purchase_id token can be acquired by any user through a low-cost purchase or by receiving a shared download link, making exploitation feasible for unauthenticated attackers. The vulnerability is classified under CWE-22 and has a CVSS 3.1 base score of 7.5, indicating high severity.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server hosting the plugin, potentially exposing sensitive information. This can lead to information disclosure without requiring user interaction or elevated privileges beyond obtaining a purchase_id token.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restricting access to the affected plugin or disabling it may reduce risk. Additionally, controlling access to purchase_id tokens and monitoring for suspicious activity related to low-cost purchases or shared download links is advisable.