CVE-2026-115497
Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
| CWE | CWE-22 |
| Vendor | codepeople |
| Product | music store – wordpress ecommerce |
| Published | Oct 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for codepeople music store – wordpress ecommerce
Be the first to know when new high vulnerabilities affecting codepeople music store – wordpress ecommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
codepeople / Music Store – WordPress eCommerce
0 ≤ 1.4.7
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/31e41b8c-f83f-4cd7-a30f-deac6154c7e3?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L378 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L371 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L400 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/music-store.php#L312 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.8
Credits
Quentin VILLAIN