WoodMart WordPress Theme Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the WoodMart plugin for WordPress, affecting all versions through 8.2.3. The vulnerability arises in the 'layout' attribute, allowing authenticated attackers with Contributor-level access or higher to include and execute arbitrary PHP files on the server. This exploitation could bypass access controls, access sensitive data, or execute code in scenarios where PHP files can be uploaded and included.

Impact

Exploitation of this vulnerability could lead to unauthorized file inclusion, allowing attackers to execute arbitrary PHP code on the server. This could be used to bypass access controls, access sensitive information, or achieve code execution in cases where uploaded PHP files can be included.

Remediation

Users are advised to update the WoodMart theme to version 8.2.4 or a newer patched version.