The Music Store WordPress Plugin: Directory traversal vulnerability (CVE-2026-115497)

The Music Store eCommerce plugin for WordPress contains a directory traversal vulnerability (CVE-2026-115497). An unauthenticated attacker can exploit this flaw by manipulating the 'f' parameter in requests to the plugin. Successful exploitation requires the attacker to possess a valid 'purchase_id' token, which can be acquired through legitimate plugin usage. This vulnerability allows for the unauthorized reading of arbitrary files on the underlying server, potentially exposing sensitive system or application configuration files.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the server's filesystem, leading to potential information disclosure of sensitive credentials, configuration files, or other private data stored on the web server.

Recommendation

• Update the "The Music Store - WordPress eCommerce" plugin to the version containing the patch for CVE-2026-115497 once available from the vendor.
• Implement web application firewall (WAF) rules to inspect the 'f' parameter for directory traversal sequences (e.g., ../, ../) in HTTP requests targeting this plugin.
• Monitor web server access logs for anomalous requests to the plugin containing directory traversal patterns in query parameters.