The Music Store – WordPress eCommerce plugin is vulnerable to a directory traversal condition when the 'f' parameter is supplied in a request. An attacker can craft a request that includes path traversal sequences in this parameter and, if they are able to obtain a valid purchase_id token, they can read the contents of any file on the server that the web process can access. This could lead to disclosure of sensitive configuration files, database credentials, user information, or other private data, jeopardizing confidentiality and potentially facilitating further attacks. The weakness is a classic path traversal flaw (CWE-22).

All installations of the Music Store – WordPress eCommerce plugin version 1.4.7 and earlier are affected. The vulnerability resides in ms-download.php and the main plugin file music-store.php as indicated by the source references. Versions 1.4.8 and later are believed to contain the fix, but the vendor has not published a formal release note for the remediation.

The CVSS score of 7.5 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires a valid purchase_id token, which an unauthenticated user can obtain by making a low‑cost purchase or by receiving a shared download link. Once the token is in hand, the attacker can send a crafted HTTP request with a manipulated 'f' value to read arbitrary files. Because the attack vector is the public web interface and no additional authentication is required beyond the token, the likelihood of exploitation in a heavily exposed environment is significant.