CVE-2025-4336 is a high severity (CVSS 8.1) arbitrary file upload in the eMagicOne Store Manager for WooCommerce plugin for WordPress, versions up to and including 1.2.5. It can be reached without a login when the default password 1:1 is unchanged. Update the plugin and change the connector password now.
What's affected
The eMagicOne Store Manager for WooCommerce plugin, all versions up to and including 1.2.5, per the record. The record says the set_file() function lacks file type validation, which lets an unauthenticated attacker upload arbitrary files to the server, and that this may make remote code execution possible.
The record adds an important condition. It is exploitable by unauthenticated attackers in default configurations where the password is left as 1:1, or where the attacker obtains the credentials. That is why the vector shows high attack complexity but no privileges.
The weakness is tagged CWE-434, unrestricted upload of a file with a dangerous type. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
The record does not state the fixed version. It lists a change in the plugin's public code repository, changeset 3308544, which points at the fix. Check the plugin page in the WordPress directory for the latest release, and confirm that its version is above 1.2.5.
How to check if you're exposed
With WP-CLI, list the plugin and its version. The plugin directory name in the repository is store-manager-connector.
wp plugin list --fields=name,version,status | grep -i store-manager
If you cannot use WP-CLI, open Plugins in the WordPress admin and read the version under the plugin name.
Then check the connector password. If you never changed it from the default, assume it is still 1:1. Also look in the uploads folder and the plugin folders for files that should not be there, such as scripts with unexpected names or recent timestamps.
find wp-content -type f -name "*.php" -newermt "2025-05-01" 2>/dev/null
Review recent file changes with your host's tools or a file integrity monitor.
What to do now
- Update the plugin to the latest release, and confirm that it is above 1.2.5.
- Change the connector password from the default to a long unique value, and check the new setting is saved.
- If you do not use the connector, deactivate and remove the plugin.
- Search for unexpected files in uploads and plugin folders, and compare with a clean copy of the plugin.
- If you find unknown files, treat the site as compromised: take it offline, restore from a clean backup, rotate WordPress, database and store API credentials.
- Block script execution in upload folders at the web server as an extra safeguard.
Try it yourself
This demo walks through a exploitability check, the kind of step that helps with findings like this one.
Click through it at your own pace, or open it full screen.
Why it matters
The cause is missing validation of what kind of file is accepted. A store connector plugin has to accept files from a remote desktop tool, and the plugin relied on a shared password to decide who may do that. A default password of 1:1 makes that gate meaningless, so a secure default would have made this far harder to use.
The record does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV), and it does not say it has been used in attacks. A public write-up by a researcher is linked from the record, so details are available to anyone who looks.
Quick check
Am I safe if I changed the password?
The record says the issue is exploitable without login in default configurations, or when an attacker gets the credentials. A changed password helps a lot, but you should still update the plugin to the fixed release.
Which version is fixed?
The record does not name one. Check the plugin page for the newest release and confirm it is above 1.2.5.
Sources
- Gold entry for CVE-2025-4336
- Gold entry for CWE-434
- Plugin changeset 3308544, listed in the CVE record
- Researcher write-up, listed in the CVE record
I fetched the write-up and the changeset page, but the text I could extract did not state a fixed version, so the guidance above comes from the record.
Last reviewed: 18 October 2026.
