CVE-2025-4602

MEDIUM

eMagicOne Store Manager for WooCommerce <1.2.5 - Info Disclosure

Title source: llm

Description

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials.

Exploits (1)

nomisec WORKING POC 1 stars

by d0n601 · poc

https://github.com/d0n601/CVE-2025-4602

View Code ZIP pw:eip

References (7)

https://plugins.trac.wordpress.org/changeset/3308544/

[Exploit, Third Party Advisory] https://github.com/d0n601/CVE-2025-4602/

[Product] https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php#L2220

[Product] https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php#L426

[Product] https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php#L35-36

[Exploit, Third Party Advisory] https://ryankozak.com/posts/cve-2025-4602/

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/20caab24-4af7-4592-9b18-f2f5acb423c9?source=cve

Scores

CVSS v3 5.9

EPSS 0.0039

EPSS Percentile 60.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-73

Status published

Products (2)

emagicone/eMagicOne Store Manager for WooCommerce < 1.2.5

emagicone/emagicone_store_manager_for_woocommerce < 1.2.5

Published May 24, 2025

Tracked Since Feb 18, 2026