CVE-2025-6744

Executive Summary

CVE-2025-6744 is a critical arbitrary shortcode execution vulnerability affecting the Woodmart theme for WordPress, up to and including version 8.2.3. The flaw resides in the woodmart_get_products_shortcode() function, which fails to properly validate user-supplied input before passing it to the do_shortcode() WordPress function. This allows an unauthenticated attacker to execute arbitrary WordPress shortcodes, potentially leading to remote code execution, data exfiltration, or complete site compromise. The vulnerability has a CVSS score of 7.3 (High) and is currently unpatched. As a WordPress ecosystem issue, this affects sites using the Woodmart theme and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability is specific to the Woodmart theme, a commercial WordPress theme distributed via ThemeForest and other marketplaces. There is no associated NPM, PyPI, Go, or Ruby package. The risk is amplified by the theme's widespread use in e-commerce and business websites. Since no official patch is available, users must rely on manual mitigation or third-party security plugins.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high base score reflects the ease of exploitation (no authentication, no user interaction) and the severe potential impact on confidentiality, integrity, and availability. An attacker can execute arbitrary shortcodes, which in WordPress can include file inclusion, database queries, and code execution.

Deep Dive & Mechanics

The vulnerability exists in the woodmart_get_products_shortcode() function, which is part of the Woodmart theme's custom shortcode handling. The function is intended to process product-related shortcodes for display purposes. However, it accepts user-supplied parameters (likely via $_GET or $_POST variables) and passes them directly to do_shortcode() without proper sanitization or validation.

In WordPress, do_shortcode() processes shortcode tags in a given string, executing any registered shortcode handlers. By injecting a malicious shortcode string, an attacker can trigger arbitrary shortcode execution. For example, if the theme has a shortcode that reads files or executes system commands, the attacker can leverage it. Even without such shortcodes, WordPress core shortcodes like [file] or custom ones from plugins can be abused.

The attack flow:

1. Attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., an AJAX action or a page that calls woodmart_get_products_shortcode()).
2. The request includes a parameter containing a malicious shortcode, such as [malicious_shortcode argument="value"].
3. The function passes this input to do_shortcode() without validation.
4. The shortcode is executed, potentially allowing the attacker to read sensitive files, execute SQL queries, or run arbitrary PHP code.

Vulnerable vs. Patched Code

Vulnerable Code (<= 8.2.3):

function woodmart_get_products_shortcode($atts) {
    // No validation of $atts before passing to do_shortcode
    $output = do_shortcode($atts['shortcode']);
    return $output;
}

Patched Code (Hypothetical):

function woodmart_get_products_shortcode($atts) {
    // Validate and sanitize input
    if (!isset($atts['shortcode']) || !is_string($atts['shortcode'])) {
        return '';
    }
    // Whitelist allowed shortcodes
    $allowed_shortcodes = array('product', 'products', 'recent_products');
    $shortcode = sanitize_text_field($atts['shortcode']);
    // Extract shortcode name
    preg_match('/\[(\w+)/', $shortcode, $matches);
    if (!in_array($matches[1], $allowed_shortcodes)) {
        return '';
    }
    $output = do_shortcode($shortcode);
    return $output;
}

The patched version adds input validation, sanitization, and a whitelist of allowed shortcodes. Without an official patch, users must implement similar checks manually.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site running Woodmart theme <= 8.2.3.
• An accessible endpoint that calls woodmart_get_products_shortcode() (e.g., via AJAX or a page template).

Exploitation Steps:

1. Identify the vulnerable endpoint. Common locations include AJAX actions like woodmart_get_products or a page with a shortcode parameter.
2. Craft a request with a malicious shortcode. For example, to read the WordPress configuration file:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=woodmart_get_products&shortcode=[file wp-config.php]
   

   (Note: [file] is a hypothetical shortcode; actual exploitation depends on available shortcodes.)
3. If the theme has a shortcode that executes PHP code (e.g., from a plugin), use it:

   shortcode=[php_eval code="system('id');"]
   

4. For a proof of concept, use a benign shortcode like [gallery] to confirm execution.

Lab Setup:

• Use a local WordPress installation with Woodmart theme version 8.2.3.
• Install a vulnerable plugin that provides a dangerous shortcode (e.g., [php_eval]) for testing.
• Use Burp Suite or cURL to send crafted requests.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual shortcode parameters in HTTP requests, especially those containing brackets [] or PHP-like syntax.
• Look for requests to AJAX endpoints with parameters like shortcode= followed by non-standard values.
• Analyze server logs for do_shortcode() calls with unexpected input.

Defense:

• Implement a Web Application Firewall (WAF) rule to block requests containing shortcode= with suspicious patterns.
• Disable unused shortcodes via WordPress filters.
• Apply input validation and sanitization on all user-supplied data before passing to do_shortcode().
• If possible, upgrade to a patched version of the theme once available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing shortcode= parameter with encoded or raw shortcode syntax.
  • Unusual AJAX requests to admin-ajax.php with action=woodmart_get_products.
  • Outbound connections to attacker-controlled servers (if shortcode executes remote code).

• File IOCs:

  • Unexpected files in the WordPress uploads directory (e.g., webshells).
  • Modified .htaccess or wp-config.php files.
  • New user accounts with administrative privileges.

• Log IOCs:

  • PHP error logs showing do_shortcode() calls with malformed input.
  • Access logs with repeated requests to the same AJAX endpoint with varying shortcode values.

Detection Engineering

YARA Rule

rule CVE_2025_6744_Woodmart_Shortcode_Exec {
    meta:
        description = "Detects attempts to exploit CVE-2025-6744 via shortcode injection in Woodmart theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6744"
    strings:
        $shortcode_param = /shortcode\s*=\s*\[/ nocase
        $woodmart_action = /action\s*=\s*woodmart_get_products/ nocase
        $do_shortcode_call = /do_shortcode\s*\(/ nocase
    condition:
        any of ($shortcode_param, $woodmart_action) and $do_shortcode_call
}

Sigma Rule

title: CVE-2025-6744 Woodmart Shortcode Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit arbitrary shortcode execution in Woodmart theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=woodmart_get_products'
        cs-uri-query|contains: 'shortcode='
        cs-uri-query|re: 'shortcode\s*=\s*\['
    condition: selection
falsepositives:
    - Legitimate use of shortcodes in admin area (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6744 Woodmart Shortcode Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=woodmart_get_products"; http_client_body; content:"shortcode="; http_client_body; pcre:"/shortcode\s*=\s*\[/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable function: If possible, remove or comment out the woodmart_get_products_shortcode() function in the theme's functions.php file.
2. Apply input validation: Add a whitelist of allowed shortcodes and sanitize all input before passing to do_shortcode().
3. Use a WAF: Deploy rules to block requests containing shortcode= with suspicious patterns.
4. Monitor logs: Actively check for exploitation attempts.

Long-term Fix:

• Wait for an official patch from the Woodmart theme vendor. Monitor their changelog and update as soon as a fix is released.
• Consider switching to a different theme if the vendor does not provide timely patches.

Workarounds:

• Disable the AJAX action that exposes the vulnerable function by adding a filter in your theme's functions.php:

  add_action('wp_ajax_woodmart_get_products', '__return_false');
  add_action('wp_ajax_nopriv_woodmart_get_products', '__return_false');
  

• Use a security plugin like Wordfence to add virtual patching.

Valters IT
Securing Digital Frontiers