CVE-2025-8097

{"id": "CVE-2025-8097", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-07-26T07:15:26.277", "references": [{"url": "https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b030aa28-5310-4f69-8b86-7e0b0bae741b?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products."}, {"lang": "es", "value": "El tema WoodMart para WordPress es vulnerable a la validaci\u00f3n de entrada incorrecta en todas las versiones hasta la 8.2.6 incluida. Esto se debe a una validaci\u00f3n insuficiente del par\u00e1metro qty en la funci\u00f3n woodmart_update_cart_item. Esto permite a atacantes no autenticados manipular las cantidades del carrito con valores fraccionarios, lo que les permite obtener productos gratis al establecer cantidades extremadamente peque\u00f1as (p. ej., 0,00001) que redondean el total del carrito a $0,00, omitiendo as\u00ed los requisitos de pago y permitiendo la adquisici\u00f3n no autorizada de productos virtuales o descargables."}], "lastModified": "2025-07-29T14:14:55.157", "sourceIdentifier": "security@wordfence.com"}