- Description
- The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.
- Source
- security@wordfence.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security@wordfence.com
- CWE-98
- Hype score
- Not currently trending
CVE-2025-6746 The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible f… https://t.co/Np8zJm8TkS
@CVEnew
8 Jul 2025
121 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2025-6746: HIGH] Vulnerable to Local File Inclusion, WoodMart plugin for WordPress versions up to 8.2.3 allows attackers to include and execute arbitrary .php files, bypassing access controls.#cve,CVE-2025-6746,#cybersecurity https://t.co/i5pIRcrtfr https://t.co/Gy5b7CClYC
@CveFindCom
8 Jul 2025
56 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xtemos:woodmart:*:*:*:*:*:wordpress:*:*",
"vulnerable": true,
"matchCriteriaId": "F0ABC5D3-C86E-4298-B8C0-A76209A8A26C",
"versionEndExcluding": "8.2.4"
}
],
"operator": "OR"
}
]
}
]