CVE-2025-48100CWE-94code-injection

CVE-2025-48100

Critical · published August 28, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

🔥 A remote code inclusion vulnerability in the bidorbuy Store Integrator means attackers can execute any code they want — like letting a hungry raccoon into your kitchen! Imagine you left your back door slightly cracked open, and a raccoon waltzes in, rummaging through your pantry and kitchenware. That’s how this vulnerability works; it allows attackers to run any code, just like that raccoon can make a mess in your home. With this vulnerability, an attacker could gain full control of your system, potentially stealing sensitive data, altering configurations, or even shutting the entire operation down. The consequences could be absolutely devastating, leading to loss of customer trust and significant financial damage. We’re talking a total nightmare for your security!

Put simply

Imagine you left your back door slightly cracked open, and a raccoon waltzes in, rummaging through your pantry and kitchenware. That’s how this vulnerability works; it allows attackers to run any code, just like that raccoon can make a mess in your home. This code injection vulnerability allows an attacker to run arbitrary code in the context of the bidorbuy Store Integrator, making it a critical risk for any installation of versions from n/a to 2.12.0. This happens due to improper validation of user input, paving the way for malicious scripts to hijack the system.

What to do

With this vulnerability, an attacker could gain full control of your system, potentially stealing sensitive data, altering configurations, or even shutting the entire operation down. The consequences could be absolutely devastating, leading to loss of customer trust and significant financial damage. We’re talking a total nightmare for your security! Immediately update your bidorbuy Store Integrator to the latest version to patch this critical vulnerability. Additionally, review your application code for any potential weaknesses that could allow similar injections. Implement strict input validation to bolster your defenses against future attacks. You've got this! By taking these steps, you'll be locking down your system tighter than a raccoon-proof trash can! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-08-28T17:15Z
References (1)
EPSS history
Timeline
  • 28 AUG 12:36Z
    WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability
    cvelistv5