CVE-2025-8097: WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation
The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmartupdatecartitem function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress/WoodMart themeto a version that resolves this vulnerability.Fixed in 8.2.6 - Configuration
Update WoodMart so woodmart_update_cart_item properly validates the qty parameter and prevents fractional/extremely small quantities from being accepted by unauthenticated attackers.
WordPress/WoodMart (woodmart_update_cart_item) qty parameter validation = Apply proper validation and reject fractional/extremely small qty values (e.g., values like 0.00001) to prevent unauthenticated cart quantity manipulation that rounds totals to $0.00
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8097?
CVE-2025-8097 is considered a high severity vulnerability due to improper input validation issues.
How do I fix CVE-2025-8097?
To fix CVE-2025-8097, update the WoodMart theme to version 8.2.7 or later.
Who is affected by CVE-2025-8097?
CVE-2025-8097 affects all versions of the WoodMart theme for WordPress up to and including version 8.2.6.
What causes CVE-2025-8097?
CVE-2025-8097 is caused by insufficient validation of the qty parameter in the woodmart_update_cart_item function.
Can unprivileged users exploit CVE-2025-8097?
Yes, unauthenticated attackers can exploit CVE-2025-8097 to manipulate the cart item quantity due to the improper input validation.