WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability
翻訳中…プラットフォーム
wordpress
コンポーネント
bidorbuystoreintegrator
修正版
2.12.1
CVE-2025-48100 describes a Remote Code Execution (RCE) vulnerability within the extremeidea bidorbuy Store Integrator plugin for WordPress. This flaw, stemming from improper control of code generation (Code Injection), allows attackers to achieve Remote Code Inclusion. The vulnerability impacts versions from 0.0.0 through 2.12.0, and a patch is available in version 2.12.1.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
影響と攻撃シナリオ翻訳中…
The impact of this RCE vulnerability is severe. An attacker can exploit this flaw to execute arbitrary code on the affected WordPress server. This could lead to complete system compromise, including data theft, modification, or deletion. The attacker could also install malware, create backdoors for persistent access, or use the compromised server as a launchpad for further attacks against other systems on the network. The ability to achieve Remote Code Inclusion significantly expands the attack surface and potential damage.
悪用の状況翻訳中…
CVE-2025-48100 has been publicly disclosed and assigned a CRITICAL CVSS score of 9.1. As of the publication date (2025-08-28), there is no indication of active exploitation campaigns. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are likely to emerge given the severity and ease of exploitation associated with Remote Code Inclusion vulnerabilities.
リスク対象者翻訳中…
WordPress websites utilizing the bidorbuy Store Integrator plugin, particularly those running older versions (0.0.0–2.12.0), are at significant risk. Shared hosting environments are especially vulnerable as they often lack granular control over plugin updates and security configurations. Sites relying on legacy WordPress installations or those with inadequate security practices are also at increased risk.
検出手順翻訳中…
• wordpress / composer / npm:
grep -r "bidorbuy Store Integrator" /var/www/html/
wp plugin list | grep bidorbuy Store Integrator• generic web:
curl -I https://your-wordpress-site.com/wp-content/plugins/bidorbuy-store-integrator/• wordpress / composer / npm:
wp plugin update bidorbuy-store-integrator攻撃タイムライン
- Disclosure
disclosure
脅威インテリジェンス
エクスプロイト状況
EPSS
0.05% (16% パーセンタイル)
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- 高 — 管理者または特権アカウントが必要。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化あり — 攻撃が脆弱なコンポーネントを超えて他のシステムに波及可能。
- Confidentiality
- 高 — 機密性の完全喪失。全データが読み取り可能。
- Integrity
- 高 — 任意のデータの書き込み・変更・削除が可能。
- Availability
- 高 — 完全なクラッシュまたはリソース枯渇。完全なサービス拒否。
影響を受けるソフトウェア
パッケージ情報
- アクティブインストール数
- 40
- プラグイン評価
- 5.0
- WordPressが必要
- 4.8+
- 動作確認済みバージョン
- 5.6.17
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
- EPSS 更新日
緩和策と回避策翻訳中…
The primary mitigation for CVE-2025-48100 is to immediately upgrade the bidorbuy Store Integrator plugin to version 2.12.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. Web Application Firewalls (WAFs) configured with rules to detect and block code injection attempts can provide an additional layer of defense. Monitor WordPress access logs for suspicious activity, particularly attempts to include external files. After upgrading, confirm the vulnerability is resolved by attempting a code inclusion attempt (if safe to do so in a test environment) and verifying that it is blocked.
修正方法翻訳中…
Actualice el plugin bidorbuy Store Integrator a la última versión disponible para mitigar la vulnerabilidad de ejecución remota de código. Verifique la página del plugin en WordPress.org para obtener la versión más reciente y las instrucciones de actualización. Considere deshabilitar o eliminar el plugin si no es esencial para su sitio web.
CVEセキュリティニュースレター
脆弱性分析と重要アラートをメールでお届けします。
よくある質問翻訳中…
What is CVE-2025-48100 — RCE in bidorbuy Store Integrator?
CVE-2025-48100 is a critical Remote Code Execution vulnerability in the bidorbuy Store Integrator WordPress plugin, allowing attackers to execute arbitrary code through Code Injection.
Am I affected by CVE-2025-48100 in bidorbuy Store Integrator?
You are affected if your WordPress site uses bidorbuy Store Integrator versions 0.0.0 through 2.12.0. Check your plugin versions immediately.
How do I fix CVE-2025-48100 in bidorbuy Store Integrator?
Upgrade the bidorbuy Store Integrator plugin to version 2.12.1 or later. If immediate upgrade is not possible, temporarily disable the plugin.
Is CVE-2025-48100 being actively exploited?
As of the publication date, there is no confirmed active exploitation, but the vulnerability's severity suggests exploitation is likely.
Where can I find the official bidorbuy Store Integrator advisory for CVE-2025-48100?
Refer to the extremeidea website and WordPress plugin repository for the latest advisory and updates regarding CVE-2025-48100.