CVE-2025-4603

🗓️ 24 May 2025 03:37:32Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 69 Views🌐 WEB

eMagicOne Store Manager plugin for WordPress allows file deletion due to poor validation, risking attacks.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for External Control of File Name or Path in Emagicone Emagicone_Store_Manager_For_Woocommerce	12 May 202519:34	–	githubexploit
Circl	CVE-2025-4603	24 May 202504:01	–	circl
CNNVD	WordPress plugin eMagicOne Store Manager for WooCommerce 安全漏洞	24 May 202500:00	–	cnnvd
Cvelist	CVE-2025-4603 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion	24 May 202503:37	–	cvelist
EUVD	EUVD-2025-28028	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4603	24 May 202504:15	–	nvd
OSV	CVE-2025-4603	24 May 202504:15	–	osv
Patchstack	WordPress eMagicOne Store Manager for WooCommerce plugin <= 1.2.5 - Unauthenticated Arbitrary File Deletion vulnerability	23 May 202522:11	–	patchstack
Positive Technologies	PT-2025-22837	24 May 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4603	26 May 202504:07	–	redhatcve

NVD

Vulners

Node

emagicone emagicone_store_manager_for_woocommerceRange≤1.2.5wordpress

[
  {
    "vendor": "emagicone",
    "product": "eMagicOne Store Manager for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php
github	www.github.com/d0n601/CVE-2025-4603/
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
ryankozak	www.ryankozak.com/posts/cve-2025-4603/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/242ad00b-3602-4988-ab7a-76fba2e9d4cf
plugins	www.plugins.trac.wordpress.org/changeset/3308544/
plugins	www.plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php

Parameter	Position	Path	Description	CWE
hash	request body	/?connector=bridge	Session key acquisition via bridge endpoint	CWE-73
task	request body	/?connector=bridge	Session key acquisition via bridge endpoint	CWE-73
path	request body	/?connector=bridge&task=delete_file	Arbitrary file deletion through delete_file with valid session key	CWE-73
key	request body	/?connector=bridge&task=delete_file	Arbitrary file deletion through delete_file with valid session key	CWE-73
task	request body	/?connector=bridge&task=delete_file	Arbitrary file deletion through delete_file with valid session key	CWE-73

08 Apr 2026 17:20Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.1

EPSS0.03022

SSVC

CWE-73