Arbitrary File Deletion Vulnerability in eMagicOne Store Manager for WooCommerce Plugin
CVE-2025-4603
What is CVE-2025-4603?
The eMagicOne Store Manager for WooCommerce plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete arbitrary files from the server. This occurs due to insufficient validation in the delete_file() function, affecting all versions up to and including 1.2.5. When exploited, this vulnerability can lead to severe consequences, such as remote code execution, especially if critical files like wp-config.php are targeted. The risk is amplified in default installations where the default credentials remain unchanged. As a result, securing this plugin is essential for maintaining the integrity and safety of WordPress sites.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
eMagicOne Store Manager for WooCommerce * <= 1.2.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
Vulnerability published
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability Reserved