Arbitrary File Upload in eMagicOne Store Manager for WooCommerce Plugin
CVE-2025-5058
What is CVE-2025-5058?
The eMagicOne Store Manager for WooCommerce plugin has a vulnerability that allows unauthenticated attackers to upload arbitrary files due to insufficient file type validation within the set_image() function. This flaw affects all versions up to and including 1.2.5. If exploited, it may lead to remote code execution on the server hosting the WordPress site. This vulnerability is particularly dangerous in default configurations, especially when the default password remains unchanged. Proper security measures are essential to mitigate the risks associated with this vulnerability.
Affected Version(s)
eMagicOne Store Manager for WooCommerce * <= 1.2.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
Vulnerability published
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability Reserved