The eMagicOne Store Manager for WooCommerce plugin suffers from an external control of file name or path vulnerability (CWE-73) in the delete_file() function. This flaw allows unauthenticated attackers to delete arbitrary files on the server if the default password remains unchanged or if credentials are compromised. The vulnerability affects all versions up to and including 1.2.5. Deleting critical files like wp-config.php can lead to remote code execution. The CVSS 3.1 base score is 9.1, reflecting network attack vector, no privileges required, no user interaction, and high impact on integrity and availability.

An attacker can delete arbitrary files on the affected server, potentially causing denial of service or enabling remote code execution by removing critical configuration files. This can compromise the integrity and availability of the affected system. The vulnerability is exploitable without authentication only if the default password is unchanged; otherwise, attacker access to credentials is required.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, it is critical to change the default password from '1:1' to a strong, unique password to prevent unauthenticated exploitation. Restrict access to credentials and monitor for unauthorized access attempts. Avoid using default configurations that enable this vulnerability.