Vulnerability feed

Executive summary

The Music Store WordPress eCommerce plugin is affected by a flaw that lets attackers read arbitrary files on the server, potentially exposing sensitive information. The advisory says all versions up to and including 1.4.7 are affected. The advisory does not state a vendor fix or recommended action beyond describing the issue.

Technical summary

The vulnerability is a directory traversal (path traversal) through the 'f' parameter, affecting all versions up to and including 1.4.7. Per the advisory, an unauthenticated attacker can read the contents of arbitrary files, which may contain sensitive information. Exploitation requires a valid purchase_id token, which the advisory says any user can obtain through a single low-cost purchase or a shared download link. The advisory does not state a fixed version, a workaround, CVSS score, exploitation in the wild, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affects

codepeopleWordPresscodepeople Music Store – WordPress eCommerceWordPress The Music Store