CVE-2026-15056

Name of the Vulnerable Software and Affected Versions StoreEngine versions prior to 2.1.2

Description The StoreEngine plugin for WordPress contains a directory traversal flaw within the parse file path() function. This issue allows authenticated users with vendor-level permissions or higher to read arbitrary files on the server, potentially exposing sensitive information.

Recommendations Update the plugin to a version newer than 2.1.1. As a temporary mitigation, restrict access to the parse file path() function for users with vendor-level permissions.