CVE-2025-32576 is a critical CSRF vulnerability in the WP shop plugin (<= 2.6.1) by Agence web Eoxia - Montpellier. It enables an attacker to perform unauthorized actions by tricking an authenticated user into submitting a forged request, specifically allowing the upload of a web shell to the server. This can lead to complete system compromise, including full control over the affected web server. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, user interaction needed, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload a web shell, which can lead to full compromise of the web server, including unauthorized data access, modification, and disruption of service. The vulnerability affects confidentiality, integrity, and availability severely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting the WP shop plugin functionality, applying web application firewall (WAF) rules to block CSRF attempts, and limiting user permissions to reduce risk.