Music Store Wordpress Ecommerce
Monthly
Unauthenticated arbitrary file read affects the Music Store - WordPress eCommerce plugin in all versions up to and including 1.4.7, where the download handler in ms-download.php passes the 'f' parameter into a file path without proper traversal protection, exposing wp-config.php, credential files and any other content readable by the web server process. The only gating requirement is a valid purchase_id token, which per the reported description any visitor can obtain through a single low-cost purchase or a shared download link, so no WordPress account or elevated privilege is needed. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, but the flaw is remotely reachable at low complexity with high confidentiality impact (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the plugin's fixed release 1.4.8 is already published.
Unauthenticated arbitrary file read affects the Music Store - WordPress eCommerce plugin in all versions up to and including 1.4.7, where the download handler in ms-download.php passes the 'f' parameter into a file path without proper traversal protection, exposing wp-config.php, credential files and any other content readable by the web server process. The only gating requirement is a valid purchase_id token, which per the reported description any visitor can obtain through a single low-cost purchase or a shared download link, so no WordPress account or elevated privilege is needed. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, but the flaw is remotely reachable at low complexity with high confidentiality impact (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the plugin's fixed release 1.4.8 is already published.