Cpe:2.3:a:the_music_store_project:the_music_store:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3athe_music_store_projectthe_music_storewordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 06:47:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgThe Music Store WordPress Plugin: Directory traversal vulnerability (CVE-2026-115497)https://feed.craftedsignal.io/briefs/2026-10-music-store-traversal/Fri, 23 Oct 2026 06:47:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-music-store-traversal/The Music Store WordPress plugin version 1.4.7 and earlier contains a directory traversal vulnerability in the f parameter, allowing unauthenticated attackers with a valid purchase_id to read arbitrary files from the server.The Music Store eCommerce plugin for WordPress contains a directory traversal vulnerability (CVE-2026-115497). An unauthenticated attacker can exploit this flaw by manipulating the 'f' parameter in requests to the plugin. Successful exploitation requires the attacker to possess a valid 'purchase_id' token, which can be acquired through legitimate plugin usage. This vulnerability allows for the unauthorized reading of arbitrary files on the underlying server, potentially exposing sensitive system or application configuration files.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the server's filesystem, leading to potential information disclosure of sensitive credentials, configuration files, or other private data stored on the web server.

Recommendation

  • Update the "The Music Store - WordPress eCommerce" plugin to the version containing the patch for CVE-2026-115497 once available from the vendor.
  • Implement web application firewall (WAF) rules to inspect the 'f' parameter for directory traversal sequences (e.g., ../, ../) in HTTP requests targeting this plugin.
  • Monitor web server access logs for anomalous requests to the plugin containing directory traversal patterns in query parameters.
]]>highadvisoryweb-applicationwordpresscve-2026-115497file-readdirectory-traversal