PT-2024-17548 · WordPress · Woodmart

Michael Mazzolini + 1 · Published 2024-12-12 · Updated 2024-12-12 · CVE-2024-12333

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Woodmart theme for WordPress versions up to 8.0.3

Description The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software permitting users to execute an action without properly validating a value before running do shortcode through the "woodmart instagram ajax query" AJAX action.

Recommendations For versions up to 8.0.3, update to a version later than 8.0.3 to resolve the issue. As a temporary workaround, consider disabling the woodmart instagram ajax query AJAX action until a patch is available. Restrict access to the do shortcode function to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-12333

Affected Products

Woodmart

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-12333 · Security Note
• https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492 · Note
• https://twitter.com/CVEnew/status/1867171850641342932 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1867173364571234451 · Twitter Post
• https://t.me/cvedetector/12758 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1caa8baa-0783-4bc9-af03-46a3a2cf3538?source=cve · Note