CVE-2025-5058 is a critical file upload vulnerability in the eMagicOne Store Manager for WooCommerce plugin for WordPress, present in all versions up to 1.2.5. The vulnerability arises from missing validation of uploaded file types in the set_image() function, enabling unauthenticated attackers to upload arbitrary files. However, exploitation requires the attacker to either leverage the default weak password (1:1) or obtain valid credentials. This flaw can potentially allow remote code execution on the affected server. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No patch or official fix has been disclosed by the vendor as of the publication date.

If exploited, this vulnerability allows unauthenticated attackers with default or compromised credentials to upload arbitrary files to the server hosting the plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The impact is critical due to the potential for full system compromise. However, exploitation is limited to environments where default credentials remain unchanged or credentials are otherwise obtained by the attacker.

As no official patch or fix is currently available, users should immediately change any default passwords from '1:1' to strong, unique credentials to prevent unauthorized access. Restrict access to the plugin's management interface and monitor for any suspicious file uploads. Check the vendor's advisory regularly for updates or official patches and apply them promptly once released.