WordPress theme

Woodmart <= 7.0.4 — Unauthenticated Arbitrary Content Injection

CVE-2023-25790Published Feb 16, 2023 · Updated Nov 13, 2026

Affected: ≤7.0.4Update to 7.1.1 or newer

All remediation steps

Watch theme

Medium5.3CVSS 3.15.3CISA KEVNot listedAccessNo account needed

On this page3

Overview

Advisory ID: CVE-2023-25790
Product: Woodmart woodmart
Affected: ≤7.0.4
Fixed in: 7.1.1
Weakness: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Required access: No account needed
Published: Feb 16, 2023 · updated Nov 13, 2026
Credit: R3N0
Source: Wordfence Intelligence

Affected≤ 7.0.4
Patched in7.1.1

5.3

CVSS 3.1 · CNA (Wordfence)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What does this vector mean?

AV:N Attack vector: Network
AC:L Attack complexity: Low
PR:N Privileges required: None
UI:N User interaction: None
S:U Scope: Unchanged
C:N Confidentiality: None
I:L Integrity: Low
A:N Availability: None

The Woodmart theme for WordPress is vulnerable to Arbitrary Content Injection in versions up to, and including, 7.0.4. The cause of this vulnerability is undisclosed at this time. However, this vulnerability makes it possible for unauthenticated attackers to inject new content onto the website, possibly through the manipulation of posts to create new web pages, spam, or phishing.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

Update to version 7.1.1, or a newer patched version
Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.

References & provenance

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

Advisorywordfence.com

Related CVEs

More vulnerabilities in Woodmart
Severity	Vulnerability	CVE	Published
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting <8.3.8Update to 8.3.8	CVE-2026-27086	Sep 04
High7.2	Unauthenticated Stored Cross-Site Scripting ≤8.5.3Update to 8.5.4	CVE-2026-56072	Jun 25
High8.1	Unauthenticated PHP Object Injection ≤8.3.8Update to 8.3.9	CVE-2026-23971	Mar 23
Medium5.3	Unauthenticated Sensitive Information Exposure ≤8.3.9Update to 8.4.0	CVE-2026-32405	Feb 22
Medium6.5	Unauthenticated Arbitrary Shortcode Execution ≤8.3.7Update to 8.3.8	CVE-2025-47600	Jan 09

Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
<8.3.8Update to 8.3.8
CVE-2026-27086Sep 04
High7.2
Unauthenticated Stored Cross-Site Scripting
≤8.5.3Update to 8.5.4
CVE-2026-56072Jun 25
High8.1
Unauthenticated PHP Object Injection
≤8.3.8Update to 8.3.9
CVE-2026-23971Mar 23
Medium5.3
Unauthenticated Sensitive Information Exposure
≤8.3.9Update to 8.4.0
CVE-2026-32405Feb 22
Medium6.5
Unauthenticated Arbitrary Shortcode Execution
≤8.3.7Update to 8.3.8
CVE-2025-47600Jan 09

Timeline

Feb 16, 2023
CVE published
Severity medium, CVSS 5.3
Nov 13, 2026
Record last updated

Sources & licenses

Wordfence record

Vulnerability data: Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVE® identifiers: Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE: National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.

How we use these sources