Path traversal in Music Store plugin lets attackers read files
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The codepeople Music Store (WordPress eCommerce) plugin is affected up to and including 1.4.7. A path traversal flaw (CWE-22) in the 'f' parameter lets requests escape the intended directory. An unauthenticated remote attacker with a valid purchase_id token can read arbitrary files on the server. Any user can get such a token through a low-cost purchase or a shared download link.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| codepeople | Music Store – WordPress eCommerce | up to 1.4.7 | — | No fix listed | CNA |
- Music Store – WordPress eCommerce Vendorcodepeople Affected up to 1.4.7 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Music Store (WordPress eCommerce).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-23 Threatist record created from CVE-2026-115497
- 2026-10-23 Alias added: GHSA-rmjv-pr48-2r29
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-23 Priority changed: LOW → MEDIUM
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/31e41b8c-f83f-4cd7-a30f-deac6154c7e3?source=cve
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L378
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L371
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L400
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/music-store.php#L312
- https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.8
More codepeople vulnerabilities
- TI-2024-00790 Booking Calendar < 1.3.83 - CSRF appointment scheduling CVSS 3.1HIGH 8.8
- TI-2024-11385 BookingPress < 1.1.23 - Unauthenticated Export File Download CVSS 3.1HIGH 7.5
- TI-2024-03387 Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRF CVSS 3.1MEDIUM 6.8
- TI-2023-05486 Contact Form Email < 1.3.44 - Editor+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2024-08220 Polls CP <= 1.0.75 - Admin+ Stored XSS via Custom Styles CVSS 3.1MEDIUM 5.4
- TI-2024-08217 Polls CP <= 1.0.75 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-115497 · CVE Program
- CVE-2026-115497 · NVD
- FIRST EPSS
- GHSA-rmjv-pr48-2r29 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences