CVE-2026-115497 Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter

Q: What is CVE-2026-115497?

CVE-2026-115497 is a high-severity vulnerability in codepeople Music Store – WordPress eCommerce, published on 23 Oct 2026.

Q: Is CVE-2026-115497 being exploited?

There is no known exploitation of CVE-2026-115497 in the wild and no public exploit code.

Q: How do I fix CVE-2026-115497?

No fix has been published for CVE-2026-115497 yet. Limit exposure of the affected software until one is available.

High 7.5 Published 23 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-115497?

CVE-2026-115497 is a high-severity vulnerability in codepeople Music Store – WordPress eCommerce, published on 23 Oct 2026.

Official description

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.

Weakness: CWE-22

Which versions are affected by CVE-2026-115497?

How do I fix CVE-2026-115497?

No fix has been published for CVE-2026-115497 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-115497 being exploited?