CVE-2025-6746

WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion

Published Jul 8, 2025 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.

Analysis

Technical impact

The WoodMart WordPress theme contains a Local File Inclusion vulnerability in all versions up to 8.2.3 through the 'layout' attribute. An authenticated user with Contributor level or higher can cause the WordPress instance to include and execute arbitrary .php files on the server, enabling any PHP code present to run. This allows attackers to bypass existing access controls, disclose sensitive information, and achieve full code execution if executable files can be placed in or pointed to on the system. The flaw is classified as CWE‑98.

Affected Systems

The vulnerability affects the xTemos WoodMart WordPress theme for versions 8.2.3 and earlier. Any WordPress site using this theme version can be impacted.

Risk and Exploitability

The CVSS score is 8.8, indicating a high severity risk. The EPSS score is under 1% which suggests a low probability of exploitation in the wild at this time, and the vulnerability is not listed in CISA KEV catalogs. Exploitation requires a valid Contributor‑level or higher authenticated session and either the ability to upload or point to a .php file that can be included by the vulnerable parameter. If these conditions are met, the attacker can run arbitrary PHP, achieving complete compromise of the affected server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

xTemos

Woodmart

unaffected

Version	Status	Constraints
`0`	affected	≤ 8.2.3

Configuration 1 [-]

cpe:2.3:a:xtemos:woodmart:*:*:*:*:*:wordpress:*:*

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—
Xtemos	Woodmart	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest version of the WoodMart theme (8.2.4 or later) which fixes the LFI flaw.
If an upgrade is not immediately possible, disable the 'layout' functionality by restricting the parameter to a safe directory or blocking its use through web‑server rules.
Restrict upload capabilities for Contributor accounts and prevent PHP execution in directories that can be targeted by the 'layout' parameter.

Generated by OpenCVE AI on April 21, 2026 at 19:48 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-20411	The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.551% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492
https://www.wordfence.com/threat-intel/vulnerabilities/id/98c1363e-b25d-46fc-b6bf-0285a37f748c?source=cve

History

Jul 14, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00086}`	epss `{'score': 0.00087}`

Jul 9, 2025 2:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Xtemos Xtemos woodmart
CPEs		cpe:2.3:a:xtemos:woodmart::::::wordpress::*
Vendors & Products		Xtemos Xtemos woodmart

Jul 8, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 8, 2025 7:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.
Title		WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion
Weaknesses		CWE-98
References		https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492 https://www.wordfence.com/threat-intel/vulnerabilities/id/98c1363e-b25d-46fc-b6bf-0285a37f748c?source=cve
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`