Arbitrary File Read Vulnerability in eMagicOne Store Manager for WooCommerce by WordPress
CVE-2025-4602
What is CVE-2025-4602?
The eMagicOne Store Manager for WooCommerce plugin exposes a critical vulnerability allowing unauthenticated attackers to exploit arbitrary file reads. This issue affects all versions up to and including 1.2.5, particularly in default configurations where the default password remains unchanged. Attackers can potentially read sensitive files on the server, which may expose important information including configuration details, user data, and more. Website administrators should apply the necessary patches and secure configurations to mitigate this risk.
Affected Version(s)
eMagicOne Store Manager for WooCommerce * <= 1.2.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
Vulnerability published
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability Reserved