CVE-2025-4602

🗓️ 24 May 2025 03:37:31Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 64 Views🌐 WEB

eMagicOne Store Manager plugin allows arbitrary file reads, exposing sensitive server information.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for External Control of File Name or Path in Emagicone Emagicone_Store_Manager_For_Woocommerce	12 May 202519:33	–	githubexploit
Circl	CVE-2025-4602	24 May 202504:02	–	circl
CNNVD	WordPress plugin eMagicOne Store Manager for WooCommerce 安全漏洞	24 May 202500:00	–	cnnvd
Cvelist	CVE-2025-4602 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read	24 May 202503:37	–	cvelist
EUVD	EUVD-2025-28027	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4602	24 May 202504:15	–	nvd
OSV	CVE-2025-4602	24 May 202504:15	–	osv
Patchstack	WordPress eMagicOne Store Manager for WooCommerce plugin <= 1.2.5 - Unauthenticated Arbitrary File Read vulnerability	23 May 202522:10	–	patchstack
Positive Technologies	PT-2025-22836 · WordPress · Emagicone Store Manager For Woocommerce	24 May 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4602	26 May 202504:07	–	redhatcve

NVD

Vulners

Node

emagicone emagicone_store_manager_for_woocommerceRange≤1.2.5wordpress

[
  {
    "vendor": "emagicone",
    "product": "eMagicOne Store Manager for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/d0n601/CVE-2025-4602/
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php
ryankozak	www.ryankozak.com/posts/cve-2025-4602/
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/20caab24-4af7-4592-9b18-f2f5acb423c9
plugins	www.plugins.trac.wordpress.org/changeset/3308544/
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php

Parameter	Position	Path	Description	CWE
hash	request body	/?connector=bridge	Authentication bypass via hash-based session key and retrieval of version information	CWE-73
task	request body	/?connector=bridge	Authentication bypass via hash-based session key and retrieval of version information	CWE-73
connector	query param	/?connector=bridge&task=get_file&key=&entity_type=.&filename=wp-config.php	Arbitrary file read via get_file with valid session key allowing access to server files	CWE-73
task	query param	/?connector=bridge&task=get_file&key=&entity_type=.&filename=wp-config.php	Arbitrary file read via get_file with valid session key allowing access to server files	CWE-73
key	query param	/?connector=bridge&task=get_file&key=&entity_type=.&filename=wp-config.php	Arbitrary file read via get_file with valid session key allowing access to server files	CWE-73
entity_type	query param	/?connector=bridge&task=get_file&key=&entity_type=.&filename=wp-config.php	Arbitrary file read via get_file with valid session key allowing access to server files	CWE-73
filename	query param	/?connector=bridge&task=get_file&key=&entity_type=.&filename=wp-config.php	Arbitrary file read via get_file with valid session key allowing access to server files	CWE-73

08 Apr 2026 17:20Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9 - 7.5

EPSS0.00394

SSVC

CWE-73