Security readout for executives and security teams
Plain-English summary
A flaw in eMagicOne Store Manager for WooCommerce through version 1.2.5 can expose arbitrary server files, potentially revealing credentials and other sensitive information. Remote attackers can exploit it when the connector retains its default 1:1 password or when they obtain valid connector credentials. The reported impact is confidentiality loss, not direct data modification or service disruption.
Executive priority
Treat this as a prompt remediation item for internet-accessible WooCommerce systems, especially those retaining default credentials. The base severity is moderate, but exposed secrets could enable broader compromise. Prioritize inventory, credential replacement, access restriction, and vendor-confirmed updating; initiate incident review if suspicious file-access activity is found.
Technical view
CVE-2025-4602 is a CWE-73 arbitrary file-read vulnerability in the plugin’s get_file() function. It is remotely reachable without WordPress authentication, although exploitation requires the default connector password or acquired connector credentials. CVSS 3.1 rates it 5.9 because attack complexity is high, while successful exploitation can cause high confidentiality impact.
Likely exposure
Exposure is most likely on WordPress and WooCommerce servers running plugin version 1.2.5 or earlier with the connector reachable remotely. Risk increases substantially where the default 1:1 password remains configured. Installations using changed, protected credentials have reduced exposure, although compromised credentials can still enable exploitation.
Exploitation context
The supplied record does not identify CVE-2025-4602 as a CISA KEV vulnerability and provides no evidence of active exploitation. Public research and repository references exist, so defenders should assume technical details are available. Exploitation remains conditional on the default password or access to connector credentials.
Researcher notes
The affected boundary is stated as all versions through 1.2.5. The CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. “Unauthenticated” means no WordPress account is required, but the stated precondition still involves the default connector password or obtained credentials. The bundle includes a WordPress changeset, but does not explicitly identify the first fixed release.
Mitigation direction
- Identify and prioritize every installation running version 1.2.5 or earlier.
- Replace the default 1:1 connector password with a strong, unique credential immediately.
- Update to a vendor-confirmed fixed release newer than 1.2.5 when available.
- Restrict remote access to the connector wherever operationally practical.
- Check vendor and WordPress guidance because the supplied sources do not name a fixed release.
Validation and detection
- Inventory WordPress sites for the Store Manager Connector plugin and record installed versions.
- Confirm whether the default 1:1 connector password has been changed.
- Determine whether the connector is reachable from untrusted networks.
- Review relevant web and application logs for unusual connector file-access activity.
- After remediation, verify the installed release against current vendor guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-73: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-4602 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N2.23.6WordfenceVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/20caab24-4af7-4592-9b18-f2f5acb423c9?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php#L35-36CVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php#L2220CVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php#L426CVE reference, Wordfence
- https://github.com/d0n601/CVE-2025-4602/CVE reference, Wordfence
- https://ryankozak.com/posts/cve-2025-4602/CVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset/3308544/CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
External Control of File Name or Path
External Control of File Name or Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.