CVE-2025-4602: Store Manager For WooCommerce File Read Flaw

CVE-2025-4602 Overview

CVE-2025-4602 affects the eMagicOne Store Manager for WooCommerce plugin for WordPress in all versions up to and including 1.2.5. The vulnerability resides in the get_file() function, which fails to properly restrict file path inputs. Unauthenticated attackers can read arbitrary files on the underlying server, exposing configuration files, credentials, and other sensitive data. Exploitation requires either the default plugin password of 1:1 to remain unchanged or knowledge of valid credentials. The flaw is categorized under [CWE-73] (External Control of File Name or Path).

Critical Impact
Unauthenticated remote attackers can read arbitrary files, including wp-config.php, exposing database credentials, authentication keys, and other sensitive WordPress secrets.

Affected Products

eMagicOne Store Manager for WooCommerce plugin for WordPress (all versions ≤ 1.2.5)
WordPress sites running the store-manager-connector plugin with default credentials 1:1
WordPress sites where attackers have obtained plugin credentials through other means

Discovery Timeline

2025-05-24 - CVE-2025-4602 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2025-4602

Vulnerability Analysis

The vulnerability stems from improper validation of file path parameters processed by the get_file() function in the Store Manager Connector plugin. The plugin exposes a remote-management endpoint at smconnector.php that accepts authenticated requests from the eMagicOne desktop client. Authentication relies on a username/password pair shipped with a default value of 1:1. When an installation retains this default, the authentication check provides no meaningful protection against unauthenticated network attackers. The get_file() handler then reads the requested file from the server filesystem and returns its contents in the response.

Because the plugin operates inside the WordPress runtime, the PHP process can access any file readable by the web server user. Attackers commonly target wp-config.php to extract database credentials and AUTH_KEY material, enabling follow-on attacks such as authenticated administrator takeover.

Root Cause

The root cause combines two weaknesses: insecure default credentials (1:1) and missing path sanitization in get_file(). The plugin trusts the file path supplied by the client without canonicalizing the path or restricting reads to a designated directory. This pattern aligns with [CWE-73], External Control of File Name or Path.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker submits an HTTP request to the connector endpoint with the default credentials 1:1 and a get_file action specifying the target path. The server returns the file contents directly. No user interaction or prior authentication to WordPress is required.

Reference the public technical write-up at Ryan Kozak CVE Analysis and the GitHub PoC Repository for request structure details. The vulnerable code paths are documented in the WordPress Plugin Code Review.

Detection Methods for CVE-2025-4602

Indicators of Compromise

HTTP POST requests to smconnector.php or related plugin endpoints containing get_file action parameters
Requests including basic authentication or form parameters using the credential pair 1:1
Outbound responses from the WordPress host returning contents of wp-config.php, /etc/passwd, or other sensitive files
Web server access logs showing repeated requests to plugin endpoints from a single external IP within a short time window

Detection Strategies

Inspect WordPress access logs for requests to /wp-content/plugins/store-manager-connector/smconnector.php originating from untrusted IPs
Alert on response bodies from plugin endpoints that contain strings such as DB_PASSWORD, AUTH_KEY, or SECURE_AUTH_KEY
Deploy WAF rules that block requests to the connector endpoint when the credential pair matches the default 1:1
Monitor for path traversal sequences (../, encoded variants) in query parameters submitted to plugin URLs

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or WAF to capture full request and response metadata for plugin endpoints
Aggregate WordPress and web server logs into a central SIEM and apply detection rules targeting plugin abuse patterns
Review installed plugin versions across the estate and flag any host running store-manager-connector at version 1.2.5 or earlier

How to Mitigate CVE-2025-4602

Immediate Actions Required

Update the eMagicOne Store Manager for WooCommerce plugin to the version released in WordPress Plugin Changeset 3308544
Change the plugin connector credentials away from the default 1:1 to a strong, unique username and password pair
Audit wp-config.php and rotate DB_PASSWORD, AUTH_KEY, SECURE_AUTH_KEY, and other secrets if exposure is suspected
Review WordPress administrator accounts for unauthorized additions or privilege changes

Patch Information

The vendor addressed the issue in a release subsequent to version 1.2.5. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the corrected source. Apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Remove or deactivate the store-manager-connector plugin until the patched version can be installed
Restrict access to plugin endpoints using web server allowlists that permit only known eMagicOne client IP addresses
Place the WordPress site behind a WAF configured to block requests carrying the default 1:1 credential pair

bash

# Update the plugin via WP-CLI
wp plugin update store-manager-connector

# Verify installed version
wp plugin get store-manager-connector --field=version

# Temporary mitigation: deactivate the plugin
wp plugin deactivate store-manager-connector