Description

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T06:16:50.340Z",
  "pubdate": "2026-08-16T06:16:50.340Z",
  "executiveSummary": "An authenticated arbitrary file read vulnerability exists within the StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress, specifically affecting all versions up to and including 2.1.1. The flaw is rooted in improper input validation within the parse_file_path function, which fails to adequately sanitize file paths supplied by users.\nThis vulnerability enables authenticated threat actors possessing vendor-level access and above to bypass intended access controls and traverse the directory structure of the underlying server. Consequently, attackers can read arbitrary files accessible to the web server process, potentially exposing sensitive system configurations, source code, credentials, and other confidential data.\nThe risk implications are severe due to the potential disclosure of sensitive information that could facilitate further compromise of the WordPress environment or the host operating system. Exploitation requires authenticated access with specific privilege levels, limiting the attack surface to trusted or compromised vendor accounts, but requires no complex interaction beyond submitting a crafted request designed to leverage the vulnerable file path parsing mechanism.",
  "technicalDetails": "The vulnerability resides in the parse_file_path function implemented within the StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress. All versions up to and including 2.1.1 are affected by this flaw.\nThe root cause of the vulnerability is insufficient sanitization and validation of input parameters handled by the vulnerable parse_file_path function. When processing file paths, the application fails to properly neutralize directory traversal sequences, such as dot-dot-slash (../) patterns, allowing input to escape the intended base directory.\nThe attack flow proceeds as follows: an authenticated attacker with vendor-level privileges or higher crafts an HTTP request containing malicious traversal sequences directed at the vulnerable component. Upon receipt, the parse_file_path function processes the manipulated path without enforcing strict boundary checks. The application then resolves the path and attempts to read or include the target file from the file system.\nBecause the web server process executes these file operations, the attacker is able to retrieve the contents of arbitrary files residing on the server, provided the web server user account possesses read permissions for those resources. This payload behavior directly exposes sensitive system files, application configuration data, and potentially database credentials.\nPrivilege requirements mandate that the attacker must authenticate to the WordPress site with at least vendor-level access. Network exposure is standard HTTP/HTTPS accessibility to the WordPress installation where the plugin is active and processing requests through its vulnerable functions."
}