CVE-2025-48148

🗓️ 20 Aug 2025 08:03:34Reported by PatchstackType

cve🔗 web.nvd.nist.gov👁 32 Views🌐 WEB

Unrestricted upload of dangerous file in StoreKeeper for WooCommerce; vulnerable up to 14.4.4.

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for CVE-2025-48148	23 Oct 202513:07	–	githubexploit
GithubExploit	Mephisto	21 May 202605:06	–	githubexploit
Circl	CVE-2025-48148	23 Oct 202511:07	–	circl
CNNVD	WordPress plugin StoreKeeper for WooCommerce 代码问题漏洞	20 Aug 202500:00	–	cnnvd
Cvelist	CVE-2025-48148 WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability	20 Aug 202508:03	–	cvelist
EUVD	EUVD-2025-28144	3 Oct 202520:07	–	euvd
NVD	CVE-2025-48148	20 Aug 202508:15	–	nvd
Packet Storm	📄 WordPress StoreKeeper for WooCommerce 14.4.4 Shell Upload	6 Feb 202600:00	–	packetstorm
Patchstack	WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability	31 Jul 202511:56	–	patchstack
Positive Technologies	PT-2025-33911 · Woocommerce · Storekeeper For Woocommerce	20 Aug 202500:00	–	ptsecurity

Vulners

Node

storekeeper_b.v.storekeeper_for_woocommerceRange≤14.4.4wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "storekeeper-for-woocommerce",
    "product": "StoreKeeper for WooCommerce",
    "vendor": "StoreKeeper B.V.",
    "versions": [
      {
        "changes": [
          {
            "at": "14.4.5",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "14.4.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/Wordpress/Plugin/storekeeper-for-woocommerce/vulnerability/wordpress-storekeeper-for-woocommerce-plugin-14-4-4-arbitrary-file-upload-vulnerability

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via WordPress admin-ajax.php using action=upload_product_image leading to arbitrary file upload (e.g., PHP web shells).	CWE-434
nonce	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via WordPress admin-ajax.php using action=upload_product_image leading to arbitrary file upload (e.g., PHP web shells).	CWE-434
file	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via WordPress admin-ajax.php using action=upload_product_image leading to arbitrary file upload (e.g., PHP web shells).	CWE-434

17 Jun 2026 09:29Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.110

EPSS0.1492

SSVC

CWE-434