CVE-2025-4336

🗓️ 24 May 2025 03:37:32Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 65 Views🌐 WEB

eMagicOne Store Manager for WooCommerce plugin vulnerable to arbitrary file uploads, remote code execution possible.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Emagicone Emagicone_Store_Manager_For_Woocommerce	5 May 202519:16	–	githubexploit
Circl	CVE-2025-4336	24 May 202504:01	–	circl
CNNVD	WordPress plugin eMagicOne Store Manager for WooCommerce 代码问题漏洞	24 May 202500:00	–	cnnvd
Cvelist	CVE-2025-4336 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()	24 May 202503:37	–	cvelist
EUVD	EUVD-2025-28003	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4336	24 May 202504:15	–	nvd
OSV	CVE-2025-4336	24 May 202504:15	–	osv
Patchstack	WordPress eMagicOne Store Manager for WooCommerce plugin <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file() vulnerability	23 May 202522:08	–	patchstack
Positive Technologies	PT-2025-22835 · WordPress · Emagicone Store Manager For Woocommerce	24 May 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4336	26 May 202504:07	–	redhatcve

NVD

Vulners

Node

emagicone emagicone_store_manager_for_woocommerceRange≤1.2.5wordpress

[
  {
    "vendor": "emagicone",
    "product": "eMagicOne Store Manager for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
ryankozak	www.ryankozak.com/posts/cve-2025-4336
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5323dbb7-3893-4b43-838b-6326505b2fb7
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php
github	www.github.com/d0n601/CVE-2025-4336
plugins	www.plugins.trac.wordpress.org/changeset/3308544/

Parameter	Position	Path	Description	CWE
connector	query param	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Unauthenticated arbitrary file upload via the bridge endpoint using set_file without proper file type validation	CWE-434
task	query param	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Unauthenticated arbitrary file upload via the bridge endpoint using set_file without proper file type validation	CWE-434
key	query param	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Unauthenticated arbitrary file upload via the bridge endpoint using set_file without proper file type validation	CWE-434
entity_type	query param	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Unauthenticated arbitrary file upload via the bridge endpoint using set_file without proper file type validation	CWE-434
filename	query param	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Unauthenticated arbitrary file upload via the bridge endpoint using set_file without proper file type validation	CWE-434

08 Apr 2026 18:24Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.1 - 9.8

EPSS0.01872

SSVC

CWE-434