The CVSS 6.5 score on CVE-2026-15056 is misleading. A vendor-authenticated arbitrary file read in a WordPress e-commerce plugin with 'Memberships, Licensing, and Affiliates' features is not a medium-severity vulnerability — it's a high-stakes operation that can cascade to full site compromise, and the 'authentication' barrier is weaker than the score assumes.
Vendor-level access in this context typically means business partners, dropshippers, or affiliates with accounts that often have weaker password policies, shared credentials, or access granted to third parties outside the organization's security perimeter. These credentials are lower-entropy than admin passwords, frequently reused, and rarely rotated after personnel changes. Treating this as a solid authentication boundary is a critical miscalculation.
The vulnerability lives in parse_file_path, a centralized file path parsing function. This is the dangerous kind of utility code: written once, used across multiple endpoints (invoices, license files, product downloads, affiliate reports), and almost never reviewed for security implications because it looks boring. One parsing failure doesn't give you one attack vector — it gives you a distributed detonation across every file-serving surface in the plugin.
The escalation path is well-established. A vendor who traverses to wp-config.php retrieves database credentials AND WordPress authentication salts. Those salts enable session cookie forgery, allowing impersonation of any user on the installation, including administrators. From admin access to plugin installation to RCE is a short walk in WordPress environments. The CVSS score measures the entry point, not the failure cascade.
Before accepting this as 'patched,' determine whether the fix was surgical or architectural. If parse_file_path received input validation in one location but wasn't audited holistically as a security-critical utility, the same pattern likely exists elsewhere in the codebase in slightly different form. Check whether file handling is now on your security review checklist, and verify that every endpoint consuming this function has been re-evaluated against the current privilege model — not the original one from years ago when the code was written for a simpler trust boundary.
Also audit for deprecated endpoints. Plugins with this feature accumulation pattern rarely clean up old handlers when features are renamed. A legacy endpoint with weaker auth assumptions may still be executing and exposing the same parsing function behind a less-audited code path.