The eMagicOne Store Manager for WooCommerce plugin allows unauthenticated users to upload any file type because the set_file() function lacks type validation. An attacker can place malicious scripts on the server, which may be executed to compromise the WordPress site, its database, and potentially the underlying operating system. This flaw is classified as CWE-434 and can lead to full remote code execution if the uploaded file is a PHP payload or other executable code.

The vulnerability affects all installations of eMagicOne Store Manager for WooCommerce version 1.2.5 and earlier. The product is a WordPress plugin developed by emagicone and identified by the CPE cpe:2.3:a:emagicone:emagicone_store_manager_for_woocommerce. Sites running default credentials or no authentication can be targeted. The issue exists in all default configuration scenarios and does not require administrative privileges.

The CVSS score of 8.1 indicates high severity. The EPSS score of 2% shows a modest likelihood of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit this weakness remotely via normal HTTP requests to the plugin’s set_file endpoint, without the need for login if the site uses default credentials or is otherwise insecure. Because the flaw permits arbitrary file upload, immediate remediation is strongly recommended.