Unauthenticated file read via unchecked path construction

Arbitrary file read in eMagicOne Store Manager for WooCommerce 1.2.5 and earlier allows remote attackers to read server files. The get_file() task accepts attacker-controlled entity_type and filename values, joins them beneath the shop root without path validation, and passes the result to readfile(). The bridge endpoint requires a session key, but the default 1:1 credentials allow remote attackers to obtain one; changed credentials limit exploitation to attackers who acquire them.