The eMagicOne Store Manager for WooCommerce plugin contains a flaw in its delete_file() function where file path validation is insufficient, allowing an attacker to delete any file on the server. This unchecked deletion can target critical files such as wp-config.php, enabling remote code execution or site compromise. The vulnerability is exploitable by unauthenticated users when the default password remains 1:1 or when credential compromise occurs.

WordPress sites running the eMagicOne Store Manager for WooCommerce plugin version 1.2.5 or older are affected. The flaw exists across all releases up to and including 1.2.5 and is not limited to any specific WordPress version.

The CVSS score of 9.1 classifies this as a critical vulnerability, and an EPSS score of 3% indicates a moderate likelihood of exploitation. The attacker does not require special credentials if the default password is still set, making the attack vector essentially any unauthenticated web request to the plugin’s deletion endpoint. Though not yet listed in the CISA KEV catalog, the straightforward nature of the exploit and the high impact warrant immediate attention.