CVE-2026-15056
Received Received - Intake

Directory Traversal in StoreEngine WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-15056
EUVD
EUVD-2026-59900

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
storeengine storeengine to 2.1.1 (inc)
storeengine complete_ecommerce_solution to 2.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Directory Traversal issue in the StoreEngine WordPress plugin up to version 2.1.1. It exists in the parse_file_path function and allows authenticated attackers with vendor-level access or higher to read arbitrary files on the server. This could expose sensitive information stored on the system.

Detection Guidance

Check for the StoreEngine plugin in WordPress installations up to version 2.1.1. Review server logs for unauthorized file access attempts or unusual file reads. Use WordPress admin access logs to identify vendor-level or higher users performing suspicious actions.

Impact Analysis

If you use the StoreEngine plugin, an attacker with sufficient access could exploit this to read sensitive files on your server. This may include configuration files, user data, or other confidential information, potentially leading to further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. Exposure of personal or health-related data may result in legal penalties, fines, or reputational damage for organizations handling such information.

Mitigation Strategies

Update the StoreEngine plugin to the latest version beyond 2.1.1 immediately. Remove vendor-level or higher user accounts that are not essential. Restrict file access permissions on the server to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart