{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3athe_music_store_projectthe_music_storewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:the_music_store_project:the_music_store:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-115497"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["The Music Store – WordPress eCommerce (\u003c= 1.4.7)"],"_cs_severities":["high"],"_cs_tags":["web-application","wordpress","cve-2026-115497","file-read","directory-traversal"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Music Store eCommerce plugin for WordPress contains a directory traversal vulnerability (CVE-2026-115497). An unauthenticated attacker can exploit this flaw by manipulating the 'f' parameter in requests to the plugin. Successful exploitation requires the attacker to possess a valid 'purchase_id' token, which can be acquired through legitimate plugin usage. This vulnerability allows for the unauthorized reading of arbitrary files on the underlying server, potentially exposing sensitive system or application configuration files.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to read arbitrary files from the server's filesystem, leading to potential information disclosure of sensitive credentials, configuration files, or other private data stored on the web server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;The Music Store - WordPress eCommerce\u0026quot; plugin to the version containing the patch for CVE-2026-115497 once available from the vendor.\u003c/li\u003e\n\u003cli\u003eImplement web application firewall (WAF) rules to inspect the 'f' parameter for directory traversal sequences (e.g., ../, ../) in HTTP requests targeting this plugin.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous requests to the plugin containing directory traversal patterns in query parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T06:47:22Z","date_published":"2026-10-23T06:47:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-music-store-traversal/","summary":"The Music Store WordPress plugin version 1.4.7 and earlier contains a directory traversal vulnerability in the f parameter, allowing unauthenticated attackers with a valid purchase_id to read arbitrary files from the server.","title":"The Music Store WordPress Plugin: Directory traversal vulnerability (CVE-2026-115497)","url":"https://feed.craftedsignal.io/briefs/2026-10-music-store-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:the_music_store_project:the_music_store:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}