==== [ Z://USB-00_RESEARCH/WORDPRESS/ ] ============================================= [ 2022 ] ==
Report Title: WordPress WoodMart Theme <= 7.1.0 - Unauthenticated Arbitrary Shortcodes Injection
Google Dork: inurl:/wp-content/themes/woodmart/
Research Date: 2022-11-12
Researcher: FearZzZz [ https://fearzzzz.ru ]
Component Vendor: XTemos [ https://themeforest.net/user/xtemos ]
Vulnerable Version: <= 7.1.0
Component Link: https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492
CVSS Base Score: 8.1 (High)
CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OWASP Top 10: A03: 2021 – Injection
#### [ Description: ]
The WoodMart premium theme for WordPress is vulnerable to Unauthenticated Arbitrary Shortcodes Injection in versions up to, and including, v7.1.0. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Note that the default WordPress shortcodes are relatively secure but other installed plugins often include insecure shortcodes, which allows to assess the potential attack threat as "medium" or "high".
#### [ Impact: ]
Malicious PHP code execution, the ability to gain full control over the attacked website, as well as retain access through the backdoor.
#### [ Payloads: ]
#### [ Proof-of-Concept: ]
GET /?s=][vc_raw_html]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_html][audio%20&post_type=product&product_cat=lighting HTTP/2
#### [ Timeline: ]
2022.11.12 - Vulnerability has been discovered.
2022.11.22 - Vendor notified, first contact attempt. No response.
2023.02.10 - Second attempt to contact the vendor. No response.
2023.02.13 - WoodMart Theme v7.1.0 released.
2023.02.13 - All the details was addressed to Envato and Patchstack. CVE ID requested.
2023.02.14 - Got a response from Envato, got a response from the vendor.
2023.02.14 - WoodMart Theme v7.1.1 released, the vulnerability has been fixed.
#### [ Contacts: ]
Email: [email protected]
#### [ Notes: ]
Prerequisite for successful exploitation: the "Display results from blog" option must be enabled on the target website (`&xts-woodmart-options[enqueue_posts_results]=1`).
Special thanks to Mikhail Kobzarev (https://t.me/mihdan | https://wp-digest.com) for providing the original theme files.
Additional greetings to Kailoon (ThemeForest Senior Reviewer, https://kailoon.com) and XTemos Studio (https://themeforest.net/user/xtemos) for the prompt response.