PT-2025-22835 · WordPress · Emagicone Store Manager For Woocommerce

Ryan Kozak

·

Published

2025-05-24

·

Updated

2025-05-29

·

CVE-2025-4336

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions eMagicOne Store Manager for WooCommerce plugin for WordPress versions up to, and including, 1.2.5
Description The issue is related to arbitrary file uploads due to missing file type validation in the set file() function. This allows unauthenticated attackers to upload arbitrary files on the affected site's server, potentially enabling remote code execution. The vulnerability is exploitable in default configurations where the default password is not changed or if an attacker gains access to the credentials.
Recommendations For versions up to, and including, 1.2.5, update to a version that includes a fix for the missing file type validation in the set file() function. As a temporary workaround, consider changing the default password and restricting access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-4336

Affected Products

Emagicone Store Manager For Woocommerce