CVE-2025-6745: WoodMart WordPress Information Disclosure

CVE-2025-6745 Overview

CVE-2025-6745 is an Information Exposure vulnerability affecting the WoodMart plugin for WordPress in all versions up to and including 8.2.5. The flaw resides in the woodmart_get_posts_by_query() function, which fails to apply proper restrictions on which posts may be returned. Unauthenticated attackers can query the function and receive content from password-protected, private, or draft posts. The issue is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). WordPress sites running WoodMart to power WooCommerce storefronts are exposed to unauthorized disclosure of unpublished commercial content, embargoed announcements, and other non-public post data.

Critical Impact
Unauthenticated remote attackers can extract data from password-protected, private, and draft WordPress posts without authorization.

Affected Products

WoodMart plugin for WordPress, versions up to and including 8.2.5
WordPress sites using WoodMart for WooCommerce storefronts
Any deployment relying on woodmart_get_posts_by_query() for content retrieval

Discovery Timeline

2025-07-11 - CVE-2025-6745 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6745

Vulnerability Analysis

The vulnerability stems from insufficient access control checks inside the woodmart_get_posts_by_query() function. WordPress distinguishes several post visibility states including publish, private, draft, and password-protected. Legitimate queries must filter results based on the requesting user's capabilities. In vulnerable WoodMart versions, the function does not enforce these visibility restrictions, so posts outside the public state are returned in query responses. The exposure is limited to confidentiality, with no direct impact on integrity or availability.

Root Cause

The root cause is missing authorization logic when constructing and filtering WP_Query results inside woodmart_get_posts_by_query(). The function accepts parameters that influence which posts to retrieve but does not validate that the caller is entitled to view non-public post statuses. Password-protected content is returned without prompting for the password, and private or draft posts are exposed to unauthenticated requests.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted requests to the WordPress endpoint that invokes woodmart_get_posts_by_query(), typically through an AJAX action or a shortcode-driven request handler exposed by the plugin. The response contains post content or metadata that would normally be gated by capability checks. Because the function does not require privileges, automated scanners can enumerate affected sites and harvest disclosed content at scale. See the Wordfence Vulnerability Report for advisory details.

Detection Methods for CVE-2025-6745

Indicators of Compromise

Anomalous unauthenticated requests to WordPress AJAX endpoints (admin-ajax.php) invoking WoodMart actions
HTTP responses returning post content with statuses other than publish to unauthenticated clients
Repeated enumeration patterns iterating over post IDs or query parameters in access logs

Detection Strategies

Review WordPress access logs for requests referencing woodmart_get_posts_by_query or related plugin AJAX actions from unauthenticated sessions
Compare returned post IDs against the site's public post inventory to identify leakage of private, draft, or password-protected content
Deploy a Web Application Firewall rule to flag requests targeting the vulnerable endpoint with post status parameters

Monitoring Recommendations

Monitor the plugin version reported by the WordPress site and alert if it remains at or below 8.2.5
Track outbound response sizes from admin-ajax.php for spikes indicative of bulk content extraction
Ingest WordPress and web server logs into a centralized analytics platform to correlate scanning activity across sites

How to Mitigate CVE-2025-6745

Immediate Actions Required

Update the WoodMart plugin to a version later than 8.2.5 as soon as the vendor releases a fixed release
Audit private, draft, and password-protected posts for evidence of prior unauthorized disclosure
Restrict access to the WordPress admin-ajax.php endpoint from untrusted networks where feasible

Patch Information

Refer to the vendor listing on ThemeForest WordPress Theme and the Wordfence Vulnerability Report for the latest patched version guidance. Apply the update through the WordPress plugin manager or via ThemeForest's update channel.

Workarounds

Deploy WAF rules that block unauthenticated requests to WoodMart AJAX actions invoking woodmart_get_posts_by_query()
Avoid storing sensitive information in WordPress drafts, private posts, or password-protected posts until patched
Disable the WoodMart plugin on sites that do not actively require it until an updated version is installed

bash

# Example WAF rule concept to block the vulnerable action
# Adjust action name and parameter matching to your environment
SecRule ARGS:action "@streq woodmart_get_posts_by_query" \
  "id:1006745,phase:2,deny,status:403,log,\
   msg:'Block CVE-2025-6745 WoodMart unauthenticated post query'"