WoodMart WordPress Theme Improper Input Validation Vulnerability Allowing Unauthenticated Cart Manipulation

A vulnerability exists in the WoodMart theme for WordPress, specifically in versions through 8.2.6, due to improper input validation of the 'qty' parameter in the 'woodmart_update_cart_item' function. This flaw enables unauthenticated attackers to alter cart quantities by using fractional values. By setting extremely small quantities that round down to zero, attackers can bypass payment requirements and acquire virtual or downloadable products without authorization.

Impact

Exploitation of this vulnerability allows for unauthorized manipulation of cart quantities, potentially leading to the acquisition of products for free.

Remediation

Users are advised to update to WoodMart version 8.2.7 or a newer patched version.