What the vulnerability does
01Description
The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products.
Explanation of Vulnerability in Simple Terms
02Summary
Woodmart versions up to 8.2.6 contain an input validation flaw that allows attackers to modify data on the site without authentication. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 8.2.6 to remediate the issue.
What an attacker can do
03Attacker Capabilities
Modify site data or content without logging in.
Potential impact on your site
04Site Impact
Attackers can alter site content, settings, or data without permission or detection.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 26, 2025
CVE published
April 8, 2026
Record updated
