CVE-2025-4336

🗓️ 24 May 2025 03:37:32Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 70 Views🌐 WEB

eMagicOne Store Manager for WooCommerce plugin vulnerable to arbitrary file uploads, remote code execution possible.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Emagicone Emagicone_Store_Manager_For_Woocommerce	5 May 202519:16	–	githubexploit
Circl	CVE-2025-4336	24 May 202504:01	–	circl
CNNVD	WordPress plugin eMagicOne Store Manager for WooCommerce 代码问题漏洞	24 May 202500:00	–	cnnvd
Cvelist	CVE-2025-4336 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()	24 May 202503:37	–	cvelist
EUVD	EUVD-2025-28003	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4336	24 May 202504:15	–	nvd
OSV	CVE-2025-4336	24 May 202504:15	–	osv
Patchstack	WordPress eMagicOne Store Manager for WooCommerce plugin <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file() vulnerability	23 May 202522:08	–	patchstack
Positive Technologies	PT-2025-22835 · WordPress · Emagicone Store Manager For Woocommerce	24 May 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4336	26 May 202504:07	–	redhatcve

NVD

Vulners

Node

emagicone emagicone_store_manager_for_woocommerceRange≤1.2.5wordpress

[
  {
    "vendor": "emagicone",
    "product": "eMagicOne Store Manager for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
ryankozak	www.ryankozak.com/posts/cve-2025-4336
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5323dbb7-3893-4b43-838b-6326505b2fb7
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php
github	www.github.com/d0n601/CVE-2025-4336
plugins	www.plugins.trac.wordpress.org/changeset/3308544/

Parameter	Position	Path	Description	CWE
hash	request body	/?connector=bridge	Session key acquisition via bridge endpoint using hash authentication	CWE-434
task	request body	/?connector=bridge	Session key acquisition via bridge endpoint using hash authentication	CWE-434
file	request body	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file endpoint (no file type validation)	CWE-434
connector	request body	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file endpoint (no file type validation)	CWE-434
task	request body	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file endpoint (no file type validation)	CWE-434
key	request body	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file endpoint (no file type validation)	CWE-434
entity_type	request body	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file endpoint (no file type validation)	CWE-434
filename	request body	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file endpoint (no file type validation)	CWE-434

17 Jun 2026 09:33Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.1 - 9.8

EPSS0.01125

SSVC

CWE-434