WordPress theme

WoodMart <= 8.0.3 — Unauthenticated Arbitrary Shortcode Execution

CVE-2024-12333Published Dec 11, 2024 · Updated Nov 13, 2026

Affected: ≤8.0.3Update to 8.0.4 or newer

All remediation steps

Watch theme

Medium6.5CVSS 3.16.5CISA KEVNot listedAccessNo account needed

On this page3

Overview

Advisory ID: CVE-2024-12333
Product: Woodmart woodmart
Affected: ≤8.0.3
Fixed in: 8.0.4
Weakness: CWE-94 Improper Control of Generation of Code
Required access: No account needed
Published: Dec 11, 2024 · updated Nov 13, 2026
Credit: Michael Mazzolini
Source: Wordfence Intelligence

Affected≤ 8.0.3
Patched in8.0.4

6.5

CVSS 3.1 · CNA (Wordfence)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What does this vector mean?

AV:N Attack vector: Network
AC:L Attack complexity: Low
PR:N Privileges required: None
UI:N User interaction: None
S:U Scope: Unchanged
C:L Confidentiality: Low
I:L Integrity: Low
A:N Availability: None

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_instagram_ajax_query AJAX action. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

Update to version 8.0.4, or a newer patched version
Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.

References & provenance

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

Advisorywordfence.com

Related CVEs

More vulnerabilities in Woodmart
Severity	Vulnerability	CVE	Published
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting <8.3.8Update to 8.3.8	CVE-2026-27086	Sep 04
High7.2	Unauthenticated Stored Cross-Site Scripting ≤8.5.3Update to 8.5.4	CVE-2026-56072	Jun 25
High8.1	Unauthenticated PHP Object Injection ≤8.3.8Update to 8.3.9	CVE-2026-23971	Mar 23
Medium5.3	Unauthenticated Sensitive Information Exposure ≤8.3.9Update to 8.4.0	CVE-2026-32405	Feb 22
Medium6.5	Unauthenticated Arbitrary Shortcode Execution ≤8.3.7Update to 8.3.8	CVE-2025-47600	Jan 09

Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
<8.3.8Update to 8.3.8
CVE-2026-27086Sep 04
High7.2
Unauthenticated Stored Cross-Site Scripting
≤8.5.3Update to 8.5.4
CVE-2026-56072Jun 25
High8.1
Unauthenticated PHP Object Injection
≤8.3.8Update to 8.3.9
CVE-2026-23971Mar 23
Medium5.3
Unauthenticated Sensitive Information Exposure
≤8.3.9Update to 8.4.0
CVE-2026-32405Feb 22
Medium6.5
Unauthenticated Arbitrary Shortcode Execution
≤8.3.7Update to 8.3.8
CVE-2025-47600Jan 09

Timeline

Dec 11, 2024
CVE published
Severity medium, CVSS 6.5
Nov 13, 2026
Record last updated

Sources & licenses

Wordfence record

Vulnerability data: Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVE® identifiers: Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE: National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.

How we use these sources