CVE-2025-4602

🗓️ 24 May 2025 03:37:31Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 81 Views🌐 WEB

eMagicOne Store Manager plugin allows arbitrary file reads, exposing sensitive server information.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for External Control of File Name or Path in Emagicone Emagicone_Store_Manager_For_Woocommerce	12 May 202519:33	–	githubexploit
Circl	CVE-2025-4602	24 May 202504:02	–	circl
CNNVD	WordPress plugin eMagicOne Store Manager for WooCommerce 安全漏洞	24 May 202500:00	–	cnnvd
Cvelist	CVE-2025-4602 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read	24 May 202503:37	–	cvelist
EUVD	EUVD-2025-28027	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4602	24 May 202504:15	–	nvd
OSV	CVE-2025-4602	24 May 202504:15	–	osv
Patchstack	WordPress eMagicOne Store Manager for WooCommerce plugin <= 1.2.5 - Unauthenticated Arbitrary File Read vulnerability	23 May 202522:10	–	patchstack
Positive Technologies	PT-2025-22836 · WordPress · Emagicone Store Manager For Woocommerce	24 May 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4602	26 May 202504:07	–	redhatcve

NVD

Vulners

Node

emagicone emagicone_store_manager_for_woocommerceRange≤1.2.5wordpress

[
  {
    "vendor": "emagicone",
    "product": "eMagicOne Store Manager for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3308544/
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/20caab24-4af7-4592-9b18-f2f5acb423c9
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php
ryankozak	www.ryankozak.com/posts/cve-2025-4602/
github	www.github.com/d0n601/CVE-2025-4602/
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php

Parameter	Position	Path	Description	CWE
hash	request body	/?connector=bridge	Session key acquisition via bridge with hash and task to obtain a session key.	CWE-73
task	request body	/?connector=bridge	Session key acquisition via bridge with hash and task to obtain a session key.	CWE-73
task	query param	/?connector=bridge	Arbitrary file read using get_file with entity_type and filename parameters; unauthenticated access to server files.	CWE-73
key	query param	/?connector=bridge	Arbitrary file read using get_file with entity_type and filename parameters; unauthenticated access to server files.	CWE-73
entity_type	query param	/?connector=bridge	Arbitrary file read using get_file with entity_type and filename parameters; unauthenticated access to server files.	CWE-73
filename	query param	/?connector=bridge	Arbitrary file read using get_file with entity_type and filename parameters; unauthenticated access to server files.	CWE-73

17 Jun 2026 09:33Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9 - 7.5

EPSS0.00581

SSVC

CWE-73