The vulnerability in the StoreEngine WordPress eCommerce plugin permits authenticated users with Subscriber level or higher to trigger a path traversal via the file_download() function. This flaw allows attackers to retrieve the contents of any file on the server that the web process can read. While the flaw does not directly trigger code execution, it leads to potential disclosure of sensitive configuration files or credentials, compromising the confidentiality of the site. The weakness is a straight path traversal issue (CWE-22).

The affected product is the StoreEngine plugin developed by kodezen. All released versions up to and including 1.5.0 are impacted. The issue resides in the add‑on CSV export path and affects any WordPress installation that has this plugin active. No specific minor revisions are listed beyond the 1.5.0 boundary.

The CVSS rating of 6.5 indicates a moderate severity, and the EPSS probability is below 1%, meaning exploitation is expected to be uncommon. The flaw is not listed in the CISA KEV catalog, suggesting limited known exploitation. However, the attack vector requires only a legitimate subscriber account, which is a common role in eCommerce sites. If the site stores sensitive user data or system files, the potential impact of data exposure is significant, especially in a broader supply‑chain context.