CVE-2025-9216highCWE-434

CVE-2025-9216: fallo de gravedad alta en kodezen StoreEngine — Complete eCommerce…

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.9%
The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import() function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
kodezen · StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More
CVEs relacionadas — kodezen StoreEngine — Complete eCommerce…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-15056MEDIUMStoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URLEPSS 1.1%CVE-2025-9215MEDIUMStoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File DownloadEPSS 0.6%