CVE-2026-15056 Kodezen — Exploit & Vulnerability Details MEDIUM

Parameter	Value
CVSS	6.5 (MEDIUM)
Type	CWE-22 (Path Traversal)
Vendor	Kodezen
Public PoC	No

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

None

No data modification

Availability

None

No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-22 Path Traversal

Vulnerable Products

kodezen:storeengine — complete ecommerce solution with memberships, licensing, affiliates & more

References 16

https://www.wordfence.com/threat-intel/vulnerabilities/id/9a866dfd-2374-4a66-9d…

Menu

CVE-2026-15056

Attack Parameters

Impact Assessment

CVSS Vector v3.1

Weakness Type (CWE)

Vulnerable Products

References 16

CVE Details

Editor's Choice

Stay informed on cybersecurity