The eMagicOne Store Manager for WooCommerce plugin contains a flaw in the get_file() function that allows attackers to request the contents of any file on the server; the vulnerability is tied to improper path handling and is classified as CWE‑73, enabling disclosure of sensitive information such as configuration files and credentials. This flaw is limited to unauthenticated attackers when the default password (1:1) remains unchanged or when the attacker has acquired credentials via other means, but once privilege is obtained, the attacker can read arbitrary files. The impact is primarily confidentiality loss, as data from the server can be accessed without authorization.

The vulnerability affects the emagicone eMagicOne Store Manager for WooCommerce plugin for WordPress in all versions up to and including 1.2.5; no other products or vendors are reported to be impacted.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests a very low exploitation probability under current conditions; the vulnerability is not listed in the CISA KEV catalog. An attacker would need access to the plugin’s default password or to valid login credentials, after which a simple HTTP request can trigger the file read, so the risk is contingent upon the default password policy and credential security