CVE-2026-15056
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
The StoreEngine plugin for WordPress up to version 2.1.1 is vulnerable to Directory Traversal via the parse_file_path function. This allows authenticated attackers with vendor-level access and above to read the contents of arbitrary files on the server, which may contain sensitive information.
Risk Assessment
An attacker can access confidential files such as configuration files, credentials, or customer data, potentially leading to security breaches and data leaks.
Recommendation
Update the StoreEngine plugin to the latest patched version. Restrict vendor-level access to trusted users only.
Original NVD description (English source)
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.