Description
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Published: 2026-08-16
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/addons/multi-vendor/api/vendors.php#L281 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/addons/multi-vendor/api/vendors.php#L37 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/addons/multi-vendor/role.php#L37 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/addons/multi-vendor/shortcode.php#L112 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/includes/classes/download-handler.php#L192 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/includes/classes/download-handler.php#L513 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/includes/classes/download-handler.php#L557 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/addons/multi-vendor/api/vendors.php#L281 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/addons/multi-vendor/api/vendors.php#L37 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/addons/multi-vendor/role.php#L37 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/addons/multi-vendor/shortcode.php#L112 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/includes/classes/download-handler.php#L192 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/includes/classes/download-handler.php#L513 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/includes/classes/download-handler.php#L557 cve-icon cve-icon
https://plugins.trac.wordpress.org/changeset?reponame=&old=3628877%40storeengine&new=3628877%40storeengine cve-icon cve-icon
https://www.wordfence.com/threat-intel/vulnerabilities/id/9a866dfd-2374-4a66-9dee-b8bda47d1cc7?source=cve cve-icon cve-icon
History

Sun, 16 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Title StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-16T05:27:29.669Z

Reserved: 2026-07-08T13:39:34.816Z

Link: CVE-2026-15056

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-16T06:16:50.340

Modified: 2026-08-16T06:16:50.340

Link: CVE-2026-15056

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T06:30:04Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')