CVE-2025-8097

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8097", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-23T17:52:17.006Z", "datePublished": "2025-07-26T06:43:22.481Z", "dateUpdated": "2026-04-08T17:15:50.129Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:50.129Z"}, "affected": [{"vendor": "xTemos", "product": "Woodmart", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.2.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products."}], "title": "WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b030aa28-5310-4f69-8b86-7e0b0bae741b?source=cve"}, {"url": "https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-20 Improper Input Validation", "cweId": "CWE-20", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Samir El Khaouti"}], "timeline": [{"time": "2025-07-23T18:07:38.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-25T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-28T15:51:46.450944Z", "id": "CVE-2025-8097", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-28T15:51:51.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8097", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-28T15:51:46.450944Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-28T15:51:49.106Z"}}], "cna": {"title": "WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "Samir El Khaouti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "xTemos", "product": "Woodmart", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.2.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-23T18:07:38.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-25T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b030aa28-5310-4f69-8b86-7e0b0bae741b?source=cve"}, {"url": "https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492"}], "descriptions": [{"lang": "en", "value": "The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:50.129Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8097", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:15:50.129Z", "dateReserved": "2025-07-23T17:52:17.006Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-26T06:43:22.481Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Woodmart", "vendor": "xTemos", "versions": [{"lessThanOrEqual": "8.2.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products."}, {"lang": "es", "value": "El tema WoodMart para WordPress es vulnerable a la validaci\u00f3n de entrada incorrecta en todas las versiones hasta la 8.2.6 incluida. Esto se debe a una validaci\u00f3n insuficiente del par\u00e1metro qty en la funci\u00f3n woodmart_update_cart_item. Esto permite a atacantes no autenticados manipular las cantidades del carrito con valores fraccionarios, lo que les permite obtener productos gratis al establecer cantidades extremadamente peque\u00f1as (p. ej., 0,00001) que redondean el total del carrito a $0,00, omitiendo as\u00ed los requisitos de pago y permitiendo la adquisici\u00f3n no autorizada de productos virtuales o descargables."}], "id": "CVE-2025-8097", "lastModified": "2026-06-17T10:06:18.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8097", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-28T15:51:46.450944Z", "version": "2.0.3"}}]}, "published": "2025-07-26T07:15:26.277", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b030aa28-5310-4f69-8b86-7e0b0bae741b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:06:28.093849+00:00", "value": {"mitigation_remediation": ["Upgrade the WoodMart theme to the latest version (at least 8.2.7) to remove the vulnerable input handling.", "If an immediate update is not possible, temporarily block or filter the qty parameter on the server side, accepting only integer values greater than or equal to 1.", "Monitor the site for anomalous cart activity and verify that no unauthorized orders appear after the patch or parameter restriction is in place."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Cart Manipulation leading to Free Product Acquisition"}, "threat_synthesis": {"affected_systems": "The problem affects the WoodMart theme sold by xTemos for WordPress environments, specifically all releases up to and including version 8.2.6. Any WordPress site that has not applied a later update is susceptible to this issue.", "description_and_impact": "The vulnerability resides in improper input validation of the qty parameter within the woodmart_update_cart_item function in the WoodMart WooCommerce theme. By sending fractional values, attackers can reduce the effective quantity to negligible amounts that cause the cart total to round to $0.00, thereby allowing unauthenticated users to obtain virtual or downloadable products without payment. This flaw permits direct manipulation of the shopping cart without authentication, potentially leading to significant financial loss for site owners.", "risk_and_exploitability": "The CVSS score of 5.3 places this flaw in the medium severity range, and the EPSS score of less than 1% indicates a low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is unauthenticated and relies on a public web interface, making it plausible for anyone to craft the needed request to manipulate the cart."}}}}, "created": "2025-07-28T12:45:48.019627+00:00", "updated": "2026-04-20T22:15:06.190328+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "xtemos", "xtemos$PRODUCT$woodmart"]}