CVE-2025-48148: Arbitrary File Access in StoreKeeper for WooCommerce
Plataforma
wordpress
Componente
storekeeper-for-woocommerce
Corregido en
14.4.5
CVE-2025-48148 describes an Arbitrary File Access vulnerability discovered in StoreKeeper for WooCommerce. This flaw allows attackers to upload files of any type, bypassing security restrictions and potentially leading to severe consequences, including remote code execution. The vulnerability affects versions from 0 through 14.4.4, and a patch is available in version 14.4.5.
Detecta esta CVE en tu proyecto
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Impacto y Escenarios de Ataquetraduciendo…
The Arbitrary File Access vulnerability in StoreKeeper for WooCommerce poses a significant threat. An attacker could upload malicious files, such as web shells or backdoors, directly to the server. This could grant them unauthorized access, allowing them to execute arbitrary code, steal sensitive data (customer information, order details, payment information), modify website content, or even take complete control of the WooCommerce store. The ability to upload any file type circumvents typical file type validation, making exploitation easier. Successful exploitation could lead to a complete compromise of the e-commerce platform and associated data, resulting in significant financial and reputational damage.
Contexto de Explotacióntraduciendo…
CVE-2025-48148 has been published on 2025-08-20. The vulnerability's CRITICAL CVSS score (10) indicates a high probability of exploitation. Public proof-of-concept (POC) code is likely to emerge, increasing the risk. Monitor security advisories and threat intelligence feeds for any signs of active exploitation campaigns targeting StoreKeeper for WooCommerce installations. The unrestricted file upload nature of this vulnerability makes it a prime target for automated scanning and exploitation.
Inteligencia de Amenazas
Estado del Exploit
EPSS
0.28% (51% percentil)
CISA SSVC
Vector CVSS
¿Qué significan estas métricas?
- Attack Vector
- Red — explotable remotamente por internet. Sin acceso físico ni local. Mayor superficie de ataque.
- Attack Complexity
- Baja — sin condiciones especiales. El atacante puede explotar de forma confiable sin configuraciones raras.
- Privileges Required
- Ninguno — sin autenticación. No se necesitan credenciales para explotar.
- User Interaction
- Ninguna — el ataque es automático y silencioso. La víctima no hace nada.
- Scope
- Cambiado — el ataque puede pivotar a otros sistemas más allá del componente vulnerable.
- Confidentiality
- Alto — pérdida total de confidencialidad. El atacante puede leer todos los datos.
- Integrity
- Alto — el atacante puede escribir, modificar o eliminar cualquier dato.
- Availability
- Alto — caída completa o agotamiento de recursos. Denegación de servicio total.
Software Afectado
Clasificación de Debilidad (CWE)
Cronología
- Reservado
- Publicada
- Modificada
- EPSS actualizado
Mitigación y Workaroundstraduciendo…
The primary mitigation for CVE-2025-48148 is to immediately upgrade StoreKeeper for WooCommerce to version 14.4.5 or later. If upgrading is not immediately possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include strict file type validation on the server-side (beyond what StoreKeeper provides), restricting file upload directories, and implementing a Web Application Firewall (WAF) with rules to block suspicious file uploads. Regularly review uploaded files for any anomalies. After upgrading, confirm the fix by attempting to upload a file with a known dangerous extension (e.g., .php) and verifying that the upload is blocked.
Cómo corregirlotraduciendo…
Actualice el plugin StoreKeeper for WooCommerce a la última versión disponible para solucionar la vulnerabilidad de carga arbitraria de archivos. Verifique las actualizaciones disponibles en el panel de administración de WordPress o en el repositorio oficial de plugins de WordPress. Asegúrese de realizar una copia de seguridad completa del sitio antes de actualizar cualquier plugin.
Preguntas frecuentestraduciendo…
What is CVE-2025-48148 — Arbitrary File Access in StoreKeeper for WooCommerce?
CVE-2025-48148 is a critical vulnerability allowing attackers to upload any file type to a StoreKeeper for WooCommerce store, potentially leading to remote code execution. It affects versions 0–14.4.4 and has a CVSS score of 10.
Am I affected by CVE-2025-48148 in StoreKeeper for WooCommerce?
If you are using StoreKeeper for WooCommerce versions 0 through 14.4.4, you are affected by this vulnerability. Immediately check your version and upgrade if necessary.
How do I fix CVE-2025-48148 in StoreKeeper for WooCommerce?
The recommended fix is to upgrade StoreKeeper for WooCommerce to version 14.4.5 or later. If immediate upgrade is not possible, implement temporary workarounds like strict file type validation and WAF rules.
Is CVE-2025-48148 being actively exploited?
While no active exploitation has been publicly confirmed, the vulnerability's CRITICAL severity and ease of exploitation suggest a high probability of exploitation. Continuous monitoring is crucial.
Where can I find the official StoreKeeper advisory for CVE-2025-48148?
Refer to the official StoreKeeper for WooCommerce website and security advisories for the latest information and updates regarding CVE-2025-48148: [https://storekeeper.github.io/]
¿Tu proyecto está afectado?
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Detecta esta CVE en tu proyecto
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Escanea tu proyecto WordPress ahora — sin cuenta
Sube cualquier manifiesto (composer.lock, package-lock.json, lista de plugins WordPress…) o pega tu lista de componentes. Recibís un reporte de vulnerabilidades al instante. Subir un archivo es solo el primer paso: con una cuenta tenés monitoreo continuo, alertas en tu canal, multi-proyecto y reportes white-label.
Arrastra y suelta tu archivo de dependencias
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...