Music Store CVE-2026-115497

Exploitation targets the 'f' parameter of the Music Store plugin's download handler (ms-download.php) in versions up to and including 1.4.7, and requires the attacker to first possess a valid purchase_id token. Per the description, that token is obtainable by any user via a single low-cost purchase or by receiving a shared download link, so it is a real but low barrier rather than account authentication. The limiting factors are therefore: the WordPress site must run the Music Store plugin at version ≤1.4.7, the plugin's download/purchase flow must be reachable, and the attacker must hold a purchase_id token; given those, no WordPress login or elevated privileges are needed (CVSS PR:N, UI:N). Impact is limited to reading files the web server process can access (C:H; no write/integrity or availability impact).

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) describes a remotely reachable, low-complexity information-disclosure flaw with high confidentiality impact and no integrity or availability impact. There is a notable tension between the CVSS metrics and the description: CVSS encodes PR:N (no privileges), yet the description states exploitation requires a valid purchase_id token obtained by making a low-cost purchase or receiving a shared download link - a low but non-zero barrier that CVSS treats as 'unauthenticated' because no account/login is strictly required. No EPSS score, KEV listing, or confirmed PoC/exploit was supplied in the input; the references are the Wordfence advisory and WordPress.org source-code lines, not working exploit code. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious but not actively-exploited issue. Net: a genuine high-severity confidentiality risk worth near-term patching, but currently lacking evidence of mass exploitation; the practical barrier of obtaining a purchase_id token makes opportunistic internet-wide scanning somewhat less trivial than a pure PR:N flaw.

An attacker makes a single low-cost purchase (or obtains a shared download link) to acquire a valid purchase_id token, then requests a download while manipulating the 'f' parameter with directory-traversal sequences to point outside the intended downloads directory. The server returns the contents of arbitrary files - such as wp-config.php, which exposes database credentials and WordPress secret keys. No public exploit code was identified in the provided input, though the vulnerable code path is pinpointed in the referenced ms-download.php source lines.