Product
The Music Store WordPress plugin version 1.4.7 and earlier contains a directory traversal vulnerability in the f parameter, allowing unauthenticated attackers with a valid purchase_id to read arbitrary files from the server.