CVE-2025-48148: Arbitrary File Access in StoreKeeper for WooCommerce
Platform
wordpress
Component
storekeeper-for-woocommerce
Opgelost in
14.4.5
CVE-2025-48148 describes an Arbitrary File Access vulnerability discovered in StoreKeeper for WooCommerce. This flaw allows attackers to upload files of any type, bypassing security restrictions and potentially leading to severe consequences, including remote code execution. The vulnerability affects versions from 0 through 14.4.4, and a patch is available in version 14.4.5.
Detecteer deze CVE in je project
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Impact en Aanvalsscenarioswordt vertaald…
The Arbitrary File Access vulnerability in StoreKeeper for WooCommerce poses a significant threat. An attacker could upload malicious files, such as web shells or backdoors, directly to the server. This could grant them unauthorized access, allowing them to execute arbitrary code, steal sensitive data (customer information, order details, payment information), modify website content, or even take complete control of the WooCommerce store. The ability to upload any file type circumvents typical file type validation, making exploitation easier. Successful exploitation could lead to a complete compromise of the e-commerce platform and associated data, resulting in significant financial and reputational damage.
Uitbuitingscontextwordt vertaald…
CVE-2025-48148 has been published on 2025-08-20. The vulnerability's CRITICAL CVSS score (10) indicates a high probability of exploitation. Public proof-of-concept (POC) code is likely to emerge, increasing the risk. Monitor security advisories and threat intelligence feeds for any signs of active exploitation campaigns targeting StoreKeeper for WooCommerce installations. The unrestricted file upload nature of this vulnerability makes it a prime target for automated scanning and exploitation.
Dreigingsinformatie
Exploit Status
EPSS
0.28% (51% percentiel)
CISA SSVC
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Geen — geen authenticatie vereist om te exploiteren.
- User Interaction
- Geen — automatische en stille aanval. Slachtoffer doet niets.
- Scope
- Gewijzigd — aanval kan voorbij het kwetsbare component uitbreiden naar andere systemen.
- Confidentiality
- Hoog — volledig verlies van vertrouwelijkheid. Aanvaller kan alle gegevens lezen.
- Integrity
- Hoog — aanvaller kan alle gegevens schrijven, aanpassen of verwijderen.
- Availability
- Hoog — volledige crash of uitputting van resources. Totale denial of service.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Gereserveerd
- Gepubliceerd
- Gewijzigd
- EPSS bijgewerkt
Mitigatie en Workaroundswordt vertaald…
The primary mitigation for CVE-2025-48148 is to immediately upgrade StoreKeeper for WooCommerce to version 14.4.5 or later. If upgrading is not immediately possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include strict file type validation on the server-side (beyond what StoreKeeper provides), restricting file upload directories, and implementing a Web Application Firewall (WAF) with rules to block suspicious file uploads. Regularly review uploaded files for any anomalies. After upgrading, confirm the fix by attempting to upload a file with a known dangerous extension (e.g., .php) and verifying that the upload is blocked.
Hoe te verhelpenwordt vertaald…
Actualice el plugin StoreKeeper for WooCommerce a la última versión disponible para solucionar la vulnerabilidad de carga arbitraria de archivos. Verifique las actualizaciones disponibles en el panel de administración de WordPress o en el repositorio oficial de plugins de WordPress. Asegúrese de realizar una copia de seguridad completa del sitio antes de actualizar cualquier plugin.
Veelgestelde vragenwordt vertaald…
What is CVE-2025-48148 — Arbitrary File Access in StoreKeeper for WooCommerce?
CVE-2025-48148 is a critical vulnerability allowing attackers to upload any file type to a StoreKeeper for WooCommerce store, potentially leading to remote code execution. It affects versions 0–14.4.4 and has a CVSS score of 10.
Am I affected by CVE-2025-48148 in StoreKeeper for WooCommerce?
If you are using StoreKeeper for WooCommerce versions 0 through 14.4.4, you are affected by this vulnerability. Immediately check your version and upgrade if necessary.
How do I fix CVE-2025-48148 in StoreKeeper for WooCommerce?
The recommended fix is to upgrade StoreKeeper for WooCommerce to version 14.4.5 or later. If immediate upgrade is not possible, implement temporary workarounds like strict file type validation and WAF rules.
Is CVE-2025-48148 being actively exploited?
While no active exploitation has been publicly confirmed, the vulnerability's CRITICAL severity and ease of exploitation suggest a high probability of exploitation. Continuous monitoring is crucial.
Where can I find the official StoreKeeper advisory for CVE-2025-48148?
Refer to the official StoreKeeper for WooCommerce website and security advisories for the latest information and updates regarding CVE-2025-48148: [https://storekeeper.github.io/]
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Detecteer deze CVE in je project
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Scan nu uw WordPress project — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...