CVE-2025-9215: Arbitrary File Access in StoreEngine

An attacker exploiting this vulnerability could potentially gain access to sensitive information stored on the web server. This could include configuration files, database credentials, source code, or other confidential data. The ability to read arbitrary files significantly expands the attack surface, allowing attackers to map the file system and identify valuable targets. While requiring authentication (Subscriber level), the widespread use of WordPress and the potential for compromised user accounts makes this a concerning vulnerability. The impact is amplified if the server hosts other sensitive applications or data.

1. Reserved2025-08-19
2. Published2025-09-17
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to a patched version of the StoreEngine plugin as soon as it becomes available. In the interim, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Additionally, restrict file permissions on the server to minimize the potential damage from a successful exploit. Regularly review WordPress user roles and permissions to ensure least privilege access. Monitor server logs for suspicious file access attempts.

Active installs

600Known

Plugin rating