CVE-2025-48148: Arbitrary File Access in StoreKeeper for WooCommerce
Platform
wordpress
Component
storekeeper-for-woocommerce
Fixed in
14.4.5
CVE-2025-48148 describes an Arbitrary File Access vulnerability discovered in StoreKeeper for WooCommerce. This flaw allows attackers to upload files of any type, bypassing security restrictions and potentially leading to severe consequences, including remote code execution. The vulnerability affects versions from 0 through 14.4.4, and a patch is available in version 14.4.5.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
The Arbitrary File Access vulnerability in StoreKeeper for WooCommerce poses a significant threat. An attacker could upload malicious files, such as web shells or backdoors, directly to the server. This could grant them unauthorized access, allowing them to execute arbitrary code, steal sensitive data (customer information, order details, payment information), modify website content, or even take complete control of the WooCommerce store. The ability to upload any file type circumvents typical file type validation, making exploitation easier. Successful exploitation could lead to a complete compromise of the e-commerce platform and associated data, resulting in significant financial and reputational damage.
Exploitation Context
CVE-2025-48148 has been published on 2025-08-20. The vulnerability's CRITICAL CVSS score (10) indicates a high probability of exploitation. Public proof-of-concept (POC) code is likely to emerge, increasing the risk. Monitor security advisories and threat intelligence feeds for any signs of active exploitation campaigns targeting StoreKeeper for WooCommerce installations. The unrestricted file upload nature of this vulnerability makes it a prime target for automated scanning and exploitation.
Threat Intelligence
Exploit Status
EPSS
0.28% (51% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2025-48148 is to immediately upgrade StoreKeeper for WooCommerce to version 14.4.5 or later. If upgrading is not immediately possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include strict file type validation on the server-side (beyond what StoreKeeper provides), restricting file upload directories, and implementing a Web Application Firewall (WAF) with rules to block suspicious file uploads. Regularly review uploaded files for any anomalies. After upgrading, confirm the fix by attempting to upload a file with a known dangerous extension (e.g., .php) and verifying that the upload is blocked.
How to fix
Actualice el plugin StoreKeeper for WooCommerce a la última versión disponible para solucionar la vulnerabilidad de carga arbitraria de archivos. Verifique las actualizaciones disponibles en el panel de administración de WordPress o en el repositorio oficial de plugins de WordPress. Asegúrese de realizar una copia de seguridad completa del sitio antes de actualizar cualquier plugin.
Frequently asked questions
What is CVE-2025-48148 — Arbitrary File Access in StoreKeeper for WooCommerce?
CVE-2025-48148 is a critical vulnerability allowing attackers to upload any file type to a StoreKeeper for WooCommerce store, potentially leading to remote code execution. It affects versions 0–14.4.4 and has a CVSS score of 10.
Am I affected by CVE-2025-48148 in StoreKeeper for WooCommerce?
If you are using StoreKeeper for WooCommerce versions 0 through 14.4.4, you are affected by this vulnerability. Immediately check your version and upgrade if necessary.
How do I fix CVE-2025-48148 in StoreKeeper for WooCommerce?
The recommended fix is to upgrade StoreKeeper for WooCommerce to version 14.4.5 or later. If immediate upgrade is not possible, implement temporary workarounds like strict file type validation and WAF rules.
Is CVE-2025-48148 being actively exploited?
While no active exploitation has been publicly confirmed, the vulnerability's CRITICAL severity and ease of exploitation suggest a high probability of exploitation. Continuous monitoring is crucial.
Where can I find the official StoreKeeper advisory for CVE-2025-48148?
Refer to the official StoreKeeper for WooCommerce website and security advisories for the latest information and updates regarding CVE-2025-48148: [https://storekeeper.github.io/]
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...