CVE-2023-32244 CRITICAL

CVE-2023-32244: WordPress Woodmart Core plugin <= 1.0.36 - Privilege Escalation

Vendor Xtemos
Product Woodmart Core
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in xtemos Woodmart Core allows Privilege Escalation.This issue affects Woodmart Core: from n/a through 1.0.36.

Explanation of Vulnerability in Simple Terms

02Summary

Woodmart Core versions up to 1.0.36 contain a privilege management flaw that allows unauthenticated attackers to read sensitive data, modify site content, and disrupt service. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update immediately to a version newer than 1.0.36.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, and disrupt service without authentication.

Potential impact on your site

04Site Impact

Attackers can compromise your site's data, content, and availability without logging in.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-13618 Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter CVE-2026-14956 Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter CVE-2026-12415 Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter CVE-2026-9018 Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter