CVE-2025-8097

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jul 26, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-80987.8An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.CVE-2025-80997.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 th CVE-2025-81005.4The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' p CVE-2025-81018.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Ta CVE-2025-81025.4The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. Thi CVE-2025-81034.3The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7.CVE-2025-81044.3The Memory Usage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.98. This is due to CVE-2025-81057.3The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due CVE-2025-81076.3In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executi CVE-2025-81086.7An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This v CVE-2025-81098.8Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.CVE-2025-81108.8Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.