Arbitrary File Upload Vulnerability in eMagicOne Store Manager for WooCommerce Plugin

CVE-2025-4336

What is CVE-2025-4336?

The eMagicOne Store Manager for WooCommerce plugin for WordPress is prone to an arbitrary file upload vulnerability due to inadequate file type validation within the set_file() function. This flaw affects all versions up to and including 1.2.5, allowing unauthenticated attackers to upload potentially harmful files to the server. If left unaddressed, this vulnerability can lead to remote code execution, particularly in default configurations with easily guessable passwords or when attackers exploit stolen credentials.

References