External risk intelligence

Bidorbuy Store Integrator Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-48100

The vulnerability affects a WordPress plugin, which is typically deployed in web-accessible environments. While it is a web-based component, plugins often operate behind the administrative interface or specific application functions rather than being public-facing by design. Therefore, while network reachability is possible in many deployments, it is not inherently a public-facing edge service or gateway.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a code injection flaw in a specific e-commerce integration tool that could allow unauthorized remote code inclusion. The main concern is confirming if this tool is deployed within our environment and, if so, determining the extent of its exposure.

Code injection flaw found in e-commerce tool.
Confirm if this specific e-commerce tool is used.
Assess tool usage and exposure if deployed.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access could exploit this vulnerability by including malicious code through the bidorbuy Store Integrator. This could lead to the inclusion of remote code, potentially allowing the attacker to execute arbitrary commands on the affected system.

Requires administrative access.
Malicious code inclusion via the integrator.
Remote code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to include and execute arbitrary code on the affected system when supported by the advisory. This could impact system integrity and availability.

System data and service behavior at risk.
Remote code inclusion via a vulnerable component.
Potential for unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The bidorbuy Store Integrator plugin's Code Injection vulnerability likely requires action from application owners and potentially platform or infrastructure teams. The first practical step is to identify all instances of the affected plugin, determine their reachability and criticality, and then assign ownership for remediation.

Identify affected plugin instances.
Verify plugin reachability and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the bidorbuy Store Integrator plugin?

The bidorbuy Store Integrator is a WordPress plugin designed to connect an e-commerce store with the bidorbuy marketplace. It helps merchants automate product synchronization, order management, and inventory updates directly through the WordPress administrative dashboard, acting as a functional bridge between the store and the marketplace platform.

What does CWE-94 mean for CVE-2025-48100?

CWE-94, or Improper Control of Generation of Code, means the software inadvertently allows external input to influence the code it executes. In this case, it enables a Remote Code Inclusion vulnerability, where an attacker can trick the plugin into loading and running malicious files, effectively allowing them to inject and execute unauthorized commands on the server.

Does this vulnerability trigger automatically when a user visits the site?

No. The vulnerability does not trigger through standard public site browsing. Exploitation requires administrative access to the WordPress environment. An attacker must already have the necessary credentials to reach and interact with the specific administrative functions of the plugin where the injection flaw exists.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal notes that while this plugin is a web-based component, it is not inherently a public-facing edge service. Because it typically operates behind administrative interfaces, the risk depends on your specific deployment. You should prioritize checking internal access controls to ensure that only authorized personnel can reach the plugin’s administrative functions.

How should I respond if I use this plugin?

Your first step is to perform an inventory of your WordPress installations to identify if and where this plugin is currently active. Once identified, evaluate the plugin's business necessity and verify who has administrative access to it. Coordinate with your team to review the plugin's status, assess its reachability, and determine a plan to secure or update the component.

References

patchstack.com/database/Wordpress/Plugin/bidorbuystoreintegrator/vul…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.