PT-2025-28338 · WordPress · Woodmart

Matthew Rollings · Published 2025-07-08 · Updated 2025-07-08 · CVE-2025-6746

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WoodMart plugin for WordPress versions up to, and including, 8.2.3

Description: The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary .php files on the server via the layout attribute. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.

Recommendations: For WoodMart plugin for WordPress versions up to, and including, 8.2.3, update to a version later than 8.2.3 to resolve the issue. As a temporary workaround, consider restricting access to the layout attribute to minimize the risk of exploitation. Additionally, restrict the ability to upload and include .php files to prevent code execution.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-6746

Affected Products

Woodmart

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-6746 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6746 · Vendor Advisory
• https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492 · Note
• https://twitter.com/CveFindCom/status/1942481342643536366 · Twitter Post
• https://twitter.com/CVEnew/status/1942522756953956741 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/98c1363e-b25d-46fc-b6bf-0285a37f748c?source=cve · Note