CVE-2026-15056 describes a CWE-22 directory traversal vulnerability in the StoreEngine — Complete eCommerce Solution WordPress plugin. The flaw exists in all versions up to and including 2.1.1 within the parse_file_path function, allowing authenticated attackers with vendor-level privileges or higher to read arbitrary server files. This can lead to unauthorized disclosure of sensitive data. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact. No patch or official remediation has been published as of the data provided.

Exploitation allows an authenticated attacker with vendor-level access or above to read arbitrary files on the server. This can result in exposure of sensitive information stored on the server, potentially compromising confidentiality. There is no indication of impact to integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict vendor-level access to trusted users only and monitor for suspicious activity related to file access. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.