Cyber Resilience

CVE-2025-48148

Critical

Published: 20 August 2025

Published
20 August 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0006 19.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-48148 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-48148 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the StoreKeeper for WooCommerce WordPress plugin from StoreKeeper B.V. The flaw enables the upload and use of malicious files, affecting all versions from n/a through 14.4.4. It carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critical due to its network accessibility, low complexity, lack of privileges or user interaction required, and scope change with high impacts across confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit this vulnerability over the network by uploading arbitrary malicious files through the plugin's functionality. Successful exploitation grants high-level compromise, potentially allowing attackers to execute arbitrary code, overwrite critical files, or achieve remote code execution on the hosting WordPress server.

The Patchstack advisory provides details on this arbitrary file upload vulnerability and mitigation guidance at https://patchstack.com/database/Wordpress/Plugin/storekeeper-for-woocommerce/vulnerability/wordpress-storekeeper-for-woocommerce-plugin-14-4-4-arbitrary-file-upload-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Using Malicious Files.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unrestricted arbitrary file upload in public-facing WordPress plugin directly enables exploitation of the application (T1190) and deployment of web shells for RCE (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and patching of the unrestricted file upload flaw in StoreKeeper for WooCommerce, directly eliminating the CVE vulnerability.

SI-10 Information Input Validation good match
prevent

Mandates validation of uploaded files for type, extension, and content to block dangerous malicious files exploited via this CVE.

SI-3 Malicious Code Protection partial match
preventdetect

Deploys malicious code protection to scan and prevent execution of arbitrarily uploaded malicious files allowed by this vulnerability.

References