CVE-2025-4336
📋 TL;DR
The eMagicOne Store Manager for WooCommerce WordPress plugin allows unauthenticated attackers to upload arbitrary files due to missing file type validation. This can lead to remote code execution on affected WordPress sites. Sites using the plugin with default credentials or compromised credentials are vulnerable.
💻 Affected Systems
- eMagicOne Store Manager for WooCommerce WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Website defacement, backdoor installation, or data exfiltration through uploaded malicious files.
If Mitigated
Limited impact if proper file upload restrictions and authentication controls are in place.
🎯 Exploit Status
Public exploit code available on GitHub; exploitation requires specific conditions but is straightforward when met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.6 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/store-manager-connector/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Store Manager for WooCommerce' and update to version 1.2.6 or higher. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate store-manager-connector
Change Default Password
allChange the default plugin password from '1:1' to a strong, unique password.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file uploads to vulnerable endpoints.
- Restrict file upload permissions and monitor upload directories for suspicious files.
🔍 How to Verify
Check if Vulnerable:
Check WordPress plugin version via admin panel or filesystem: wp plugin list | grep store-manager-connectorCheck Version:
wp plugin get store-manager-connector --field=versionVerify Fix Applied:
Confirm plugin version is 1.2.6 or higher and test file upload functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to plugin endpoints
- POST requests to /wp-content/plugins/store-manager-connector/
Network Indicators:
- HTTP requests with file uploads to vulnerable plugin paths
SIEM Query:
source="web_logs" AND uri_path="/wp-content/plugins/store-manager-connector/" AND method="POST" AND file_upload="true"🔗 References
- https://github.com/d0n601/CVE-2025-4336
- https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php
- https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php#L441
- https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php#L35-36
- https://ryankozak.com/posts/cve-2025-4336
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5323dbb7-3893-4b43-838b-6326505b2fb7?source=cve
