PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-115497 codepeople CVE debrief

CVE-2026-115497 is a high-severity directory traversal vulnerability in the Music Store – WordPress eCommerce plugin, allowing unauthenticated arbitrary file read. This vulnerability affects WordPress installations with the Music Store – WordPress eCommerce plugin versions up to 1.4.7. The vulnerability is caused by the 'f' parameter in the plugin, which can be exploited by unauthenticated attackers to read arbitrary files on the server, potentially containing sensitive information. Exploitation requires a valid purchase_id token, which can be obtained by making a low-cost purchase or receiving a shared download link. Defenders should prioritize verifying exposure and implementing

Vendor
codepeople
Product
Music Store – WordPress eCommerce
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-23
Advisory published
2026-10-23
Advisory updated
2026-10-23

Who should care

Defenders responsible for WordPress installations with the Music Store – WordPress eCommerce plugin versions up to 1.4.7 should assess exposure and implement compensating controls.

Why it matters

CVE-2026-115497 is a high-severity vulnerability in the Music Store – WordPress eCommerce plugin, allowing unauthenticated arbitrary file read. Defenders should prioritize verifying exposure and implementing compensating controls.

  • Verify exposure of Music Store – WordPress eCommerce plugin versions up to 1.4.7
  • Implement compensating controls to restrict file access
  • Monitor for suspicious file read attempts

Technical summary

The Music Store – WordPress eCommerce plugin is vulnerable to directory traversal in versions up to 1.4.7 via the 'f' parameter. This allows unauthenticated attackers to read arbitrary files on the server, potentially containing sensitive information. Exploitation requires a valid purchase_id token, which can be obtained by making a low-cost purchase or receiving a shared download link. The vulnerability has a high severity score of 7.5 and is classified as HIGH. The CVE record and source item provide evidence of the vulnerability and its impact.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls for Music Store – WordPress eCommerce plugin versions up to 1.4.7.

Recommended defensive actions

  • Verify exposure of Music Store – WordPress eCommerce plugin versions up to 1.4.7
  • Implement compensating controls to restrict file access
  • Monitor for suspicious file read attempts
  • Update to a fixed version when available
  • Review vendor guidance and apply patches
  • Conduct a thorough review of the affected system
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the directory traversal vulnerability in Music Store – WordPress eCommerce plugin versions up to 1.4.7. The vulnerability allows unauthenticated attackers to read arbitrary files on the server, potentially containing sensitive information. The source item and CVE record provide evidence of the vulnerability and its impact. The vulnerability has a high severity score of 7.5 and is classified as HIGH. The CVE record was published on 2026-10-23T04:31:53.752Z and has not been modified

Sources and references

Verified primary and authoritative sources

  • CVE-2026-115497 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-115497

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-115497 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115497

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115497.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/music-store.php

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.8

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.