Vulnerability · Published Aug 16, 2026 · Assigned by Wordfence

CVE-2026-15056StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL

Medium 6.5

In plain English

A medium-severity path traversal in StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More from kodezen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.1%top 34.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products (as reported)

Vendor	Product	Versions
kodezen	StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More	0 – through 2.1.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References