CVE-2025-8097 Business logic in Woodmart
Unauthenticated attackers can manipulate cart quantities to bypass payment and acquire products for free in the WoodMart WordPress theme.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8097?
CVE-2025-8097 is a medium-severity vulnerability in xTemos Woodmart, published on 26 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products.
Weakness: CWE-20
Which versions are affected by CVE-2025-8097?
How do I fix CVE-2025-8097?
No fix has been published for CVE-2025-8097 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8097 being exploited?
There is no known exploitation of CVE-2025-8097 in the wild and no public exploit code.
Sources
Also known as GHSA-qrc2-mj9g-ghm5.