The vulnerability resides in the set_image() function of the eMagicOne Store Manager for WooCommerce plugin, where missing file type validation allows an attacker to upload any file type. This flaw enables unauthenticated remote attackers to place malicious code on the server, potentially leading to remote code execution if the uploaded file is later executed.

WordPress sites running the eMagicOne Store Manager for WooCommerce plugin from vendors emagicone, with versions up to and including 1.2.5. The issue affects all installations of these versions regardless of other site configuration, unless the plugin is upgraded beyond 1.2.5.

The CVSS score of 9.8 classifies the flaw as critically severe. An EPSS score of 2% indicates a moderate probability that the vulnerability is actively exploited in the wild. The issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication when the default password remains in its insecure default form (1:1) or when they have obtained valid credentials. Once a file is uploaded, an attacker may be able to execute code by accessing the file directly or by leveraging additional application logic that processes uploaded files.