StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL

Summary

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Timeline

1. Aug 16, 2026, 5:27 AM UTCCVE published
2. Aug 17, 2026, 2:14 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Aug 17, 2026, 4:05 PM UTCRecord last updated

Affected versions

• kodezen StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More

  through 2.1.1

References 16