Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-115497 · Microsoft / collected KEV context

cve-program · CVE-2026-115497

• https://www.wordfence.com/threat-intel/vulnerabilities/id/31e41b8c-f83f-4cd7-a30f-deac6154c7e3?source=cve
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L378
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L371
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/ms-core/ms-download.php#L400
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.7/music-store.php#L312
• https://plugins.trac.wordpress.org/browser/music-store/tags/1.4.8

• Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter · Newly collected advisory · 23 Oct 2026