CVE-2025-4602

Katalog CVE

CVSS 7.5 · High EPSS 0,68%

Kerentanan External Control of File Name or Path pada emagicone store manager for woocommerce. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials.

Rincian

Terbit di NVD

24 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 50,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/d0n601/CVE-2025-4602/ exploit · advisory pihak ketiga
• https://ryankozak.com/posts/cve-2025-4602/ exploit · advisory pihak ketiga
• https://www.wordfence.com/threat-intel/vulnerabilities/id/20caab24-4af7-4592-9b18-f2f5acb423c9?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.ph... product
• https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverri... product
• https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php#L35-36 product
• https://plugins.trac.wordpress.org/changeset/3308544/