CVE-2026-115497

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.

• CWE-22

• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L371
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L378
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L400
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/music-store.php#L312
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.8
• https://www.wordfence.com/threat-intel/vulnerabilities/id/31e41b8c-f83f-4cd7-a30f-deac6154c7e3?source=cve

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115484A flaw was found in the iscsiuio component of open-iscsi. Th…7.6
• CVE-2026-115485A flaw was found in the iscsiuio component of open-iscsi. Th…6.3
• CVE-2026-115486A flaw was found in the iscsiuio component of open-iscsi. Th…7.1
• CVE-2026-11549IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSph…6.5
• CVE-2026-115494A flaw in the cross-site request forgery (CSRF) prevention o…5.3
• CVE-2026-115496Overly informative error messages in the catalog functionali…6.9
• CVE-2026-1155A vulnerability was found in Totolink LR350 9.3.5u.6369_B202…8.8
• CVE-2026-115502A missing authorization check allows anyone having access to…6.3
• CVE-2026-115503Ghidra before 12.2 contains an improper handling of highly c…5.5
• CVE-2026-115504CFITSIO through 4.7.0 contains an out-of-bounds write vulner…7.8
• CVE-2026-115505libsmb2 before 6.3 contains integer overflow vulnerabilities…7.6
• CVE-2026-115506libexpat through 2.9.0 contains a denial of service vulnerab…7.5