What is the CVSS score of EUVD-2026-59900?

EUVD-2026-59900 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

StoreEngine EUVD-2026-59900

| CVE-2026-15056 MEDIUM

Path Traversal (CWE-22)

2026-08-16 Wordfence

GHSA-86rr-wqcm-c4j3

WordPress Path Traversal Wordpress Plugin Storeengine Complete Ecommerce Solution With Memberships Licensing Affiliates More Kodezen

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable by authenticated vendor-level users (PR:L); no integrity or availability impact; confidentiality fully compromised via arbitrary file read.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:19 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

MEDIUM 6.5

DescriptionCVE.org

The StoreEngine - Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

Directory traversal in the StoreEngine WordPress plugin (Kodezen) through version 2.1.1 exposes arbitrary server files to authenticated users holding vendor-level access or higher. The flaw resides in the parse_file_path function, which insufficiently sanitizes file path input across the plugin's download handler and multi-vendor addon components, allowing path sequences to escape the intended directory. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the confidentiality impact is high given that readable files may include WordPress configuration, database credentials, or private keys.

Technical ContextAI

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The affected component is the StoreEngine WordPress plugin by Kodezen, identified by CPE cpe:2.3:a:kodezen:storeengine_-_complete_ecommerce_solution_with_memberships,_licensing,_affiliates_&_more:*:*:*:*:*:*:*:*. Source code references in the WordPress plugin trac repository point to three distinct vulnerable locations within the plugin: includes/classes/download-handler.php (lines 192, 513, and 557), and the multi-vendor addon files addons/multi-vendor/api/vendors.php, addons/multi-vendor/role.php, and addons/multi-vendor/shortcode.php. The parse_file_path function, rather than using an allowlist or canonicalized base-path enforcement, appears to accept user-supplied path segments that can include ../ sequences or equivalent traversal patterns, causing the server to resolve paths outside the plugin's intended file serving directory.

RemediationAI

No vendor-released patch version is identified in the available intelligence data at time of analysis; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9a866dfd-2374-4a66-9dee-b8bda47d1cc7 should be consulted for the latest patch availability and confirmed fixed release. Until a patched version is confirmed and applied, site operators should consider disabling the multi-vendor addon entirely if vendor marketplace functionality is not business-critical, as this removes the externally-accessible attack surface at addons/multi-vendor/. Alternatively, restricting vendor account registration and auditing existing vendor-role user accounts limits who can trigger the vulnerable code path. Web application firewall rules targeting path traversal patterns (../, ..%2F, %2F..) in request parameters processed by the plugin can serve as a compensating control, though these can be bypassed by determined attackers and should not substitute for patching. Operators should also audit server-side file permissions to ensure the web server process cannot read sensitive files such as wp-config.php from directories outside the web root where feasible.