PT-2025-38123 · WordPress · Storeengine

Ryan Kozak · Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-9216

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions StoreEngine versions up to and including 1.5.0

Description The StoreEngine WordPress plugin is susceptible to arbitrary file uploads due to the absence of file type validation within the import() function. This allows authenticated attackers possessing Subscriber-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations Update StoreEngine to a version beyond 1.5.0.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-9216

Affected Products

Storeengine

References · 10

• 🔥 https://github.com/d0n601/CVE-2025-9216 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9216 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7f8cc393-4d6f-4d15-ad95-d4a89dfe433c?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1968237072335905201 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3360097/storeengine/trunk/addons/csv/ajax/import.php · Note
• https://twitter.com/CVEnew/status/1968349190804967818 · Twitter Post
• https://t.me/CVEtracker/32725 · Telegram Post
• https://ryankozak.com/posts/cve-2025-9216 · Note
• https://plugins.trac.wordpress.org/browser/storeengine/trunk/addons/csv/ajax/import.php#L52 · Note
• https://t.me/cveNotify/135634 · Telegram Post