CVE-2025-4603

CVE-2025-4603 describes an arbitrary file deletion vulnerability in the eMagicOne Store Manager for WooCommerce plugin for WordPress, affecting all versions up to and including 1.2.5. This critical flaw allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution by targeting critical files like wp-config.php, especially if default credentials are unchanged or compromised. With a CVSS score of 9.1 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in high impact to integrity and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, its high FAUCET Risk Score of 85/100 indicates a serious threat.