The vulnerability resides in the parse_file_path function of the StoreEngine plugin. By manipulating a file‑path parameter, an authenticated user with vendor or higher privileges can trigger a directory traversal, allowing the attacker to read arbitrary files on the host filesystem, potentially exposing credentials, configuration files, or other sensitive data. The flaw represents a classic path traversal weakness (CWE‑22) and yields read access only; it does not lead to code execution or elevation of privileges.

The defect affects all StoreEngine releases up to and including 2.1.1, which is deployed as a WordPress plugin for e‑commerce, membership, and licensing functionality. Administrators on WordPress sites using these versions are vulnerable especially when vendor‑level users are granted sufficient access within the plugin.

The CVSS score of 6.5 categorizes the issue as medium severity. No EPSS score is available, but the requirement for authenticated vendor‑level credentials limits the immediate threat. The vulnerability is not listed in the CISA KEV catalog, indicating no current widespread exploitation. The attacker must first obtain vendor‑level access—by compromise, social engineering, or credential reuse—to exploit the path traversal and read arbitrary files on the server.