The Woodmart WordPress theme is vulnerable to arbitrary shortcode execution when the woodmart_get_products_shortcode() function calls do_shortcode without validating its input. This flaw, a CWE‑94 code‑generation vulnerability, permits any unauthenticated user to inject malicious shortcodes that are processed by WordPress, potentially enabling remote code execution or other disruptive actions on the site.

The vulnerability affects the Woodmart theme version 8.2.3 and all earlier releases. Any WordPress site that has not upgraded beyond 8.2.3 is at risk. The affected component is identified by the CPE string indicating the Woodmart theme installed on a WordPress environment.

The CVSS score of 7.3 indicates a high severity, though the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. Attackers would target the theme via unauthenticated HTTP requests to the WordPress site, supplying crafted shortcode payloads. Given the lack of authentication requirements and the high potential impact, the threat remains significant while the likelihood of exploitation remains low according to EPSS.