CVE-2025-4336

🗓️ 24 May 2025 03:37:32Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 80 Views🌐 WEB

eMagicOne Store Manager for WooCommerce plugin vulnerable to arbitrary file uploads, remote code execution possible.

Reporter	Title	Published	Views	Family All 12
githubexploit	Exploit for Unrestricted Upload of File with Dangerous Type in Emagicone Emagicone_Store_Manager_For_Woocommerce	5 May 202519:16	–	githubexploit
circl	CVE-2025-4336	24 May 202504:01	–	circl
cnnvd	WordPress plugin eMagicOne Store Manager for WooCommerce 代码问题漏洞	24 May 202500:00	–	cnnvd
cvelist	CVE-2025-4336 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()	24 May 202503:37	–	cvelist
euvd	EUVD-2025-28003	3 Oct 202520:07	–	euvd
nvd	CVE-2025-4336	24 May 202504:15	–	nvd
osv	CVE-2025-4336	24 May 202504:15	–	osv
patchstack	WordPress eMagicOne Store Manager for WooCommerce plugin <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file() vulnerability	23 May 202522:08	–	patchstack
ptsecurity	PT-2025-22835 · WordPress · Emagicone Store Manager For Woocommerce	24 May 202500:00	–	ptsecurity
redhatcve	CVE-2025-4336	26 May 202504:07	–	redhatcve

NVD

Vulners

Node

emagicone emagicone_store_manager_for_woocommerceRange≤1.2.5wordpress

[
  {
    "vendor": "emagicone",
    "product": "eMagicOne Store Manager for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
ryankozak	www.ryankozak.com/posts/cve-2025-4336
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5323dbb7-3893-4b43-838b-6326505b2fb7
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php
github	www.github.com/d0n601/CVE-2025-4336
plugins	www.plugins.trac.wordpress.org/changeset/3308544/

Parameter	Position	Path	Description	CWE
hash	request body	/?connector=bridge	Bridge endpoint for session key acquisition using hash (default credentials).	CWE-434
task	request body	/?connector=bridge	Bridge endpoint for session key acquisition using hash (default credentials).	CWE-434
file	binary	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file with a valid session key, enabling potential remote code execution.	CWE-434
key	binary	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file with a valid session key, enabling potential remote code execution.	CWE-434
entity_type	binary	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file with a valid session key, enabling potential remote code execution.	CWE-434
filename	binary	/?connector=bridge&task=set_file&key=&entity_type=.&filename=hello.txt	Arbitrary file upload via set_file with a valid session key, enabling potential remote code execution.	CWE-434

17 Jun 2026 09:33Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.1 - 9.8

EPSS0.01125

SSVC

CWE-434