Security Alert Summary
The Music Store – WordPress eCommerce plugin (all versions up to and including 1.4.7) contains a directory traversal vulnerability in its download handling that can allow an unauthenticated attacker with a valid purchase_id token to read arbitrary files on the server via the f parameter. A valid purchase_id can be obtained by making a low-cost purchase or receiving a shared download link.
CVE Details
- CVE ID: CVE-2026-115497
- Affected component: Music Store – WordPress eCommerce plugin (download handling)
- Affected versions: All versions up to and including 1.4.7
- Published: October 23, 2026 at 05:17:15 AM UTC
- Last modified: October 23, 2026 at 02:20:57 PM UTC
- CVSS v3.1: Base Score 7.5, Severity HIGH
- CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Authentication / Privileges / User Interaction: No authentication required to exploit if a valid
purchase_idtoken is available; Privileges Required: None; User Interaction: None - Primary impact: Confidentiality: High; Integrity: None; Availability: None
- Weakness (CWE): CWE-22 (Path Traversal)
Technical Details
The vulnerability is a directory traversal issue reachable via the f parameter used by the plugin’s download handling. An attacker who supplies a crafted f value can cause the plugin to return the contents of arbitrary files on the server. Exploitation requires possession of a valid purchase_id token, which can be obtained by completing a low-cost purchase or by using a shared download link.
The issue is associated with the plugin’s download endpoint code (referenced in ms-download.php in the plugin codebase). The root cause is the ability to influence a file path returned to the requester without sufficient path validation or sanitization, enabling traversal outside the intended download directory. The impact is limited to disclosure of file contents; the CVSS data indicates confidentiality impact only.
How This Could Impact Your Website
Consider a small team-managed music store site: the site owner manages products, internal staff handle orders and fulfillment, and external contributors or customers may receive shared download links. If an attacker obtains or is given a valid purchase_id token—for example by making a nominal purchase or using a shared link—they could use the f parameter to read files on the server. Those files might include configuration files or other data that contain sensitive information such as database credentials or internal user email addresses.
Practical consequences include exposure of internal user email addresses and increased risk of targeted phishing or social engineering against staff or customers. The vulnerability does not, based on the provided data, indicate modification of files or direct site takeover, but disclosure of sensitive files can materially increase the risk to your site and users.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles that can access or share download links.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual download requests or repeated attempts to access files outside expected paths.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L371
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L378
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L400
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/music-store.php#L312
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/31e41b8c-f83f-4cd7-a30f-deac6154c7e3?source=cve
