CVE-2025-6746

HIGH

WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-6746 has a selected CVSS score of 8.8 (high).

Description

The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 8, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Woodmart

Browse xTemos / Woodmart

Default status: unaffected

CVE ListThrough 8.2.3affected

References

3