CVE-2025-8097: WoodMart WordPress Auth Bypass Vulnerability

CVE-2025-8097 Overview

CVE-2025-8097 is an improper input validation vulnerability [CWE-20] affecting the WoodMart theme for WordPress in all versions up to and including 8.2.6. The flaw resides in the woodmart_update_cart_item function, which fails to properly validate the qty parameter submitted during cart updates. Unauthenticated attackers can submit fractional quantities such as 0.00001, causing the cart total to round down to $0.00. This bypasses payment enforcement and allows unauthorized acquisition of virtual or downloadable products from affected WooCommerce storefronts.

Critical Impact
Unauthenticated attackers can obtain virtual or downloadable products without payment by manipulating cart quantities with fractional values that round the total to zero.

Affected Products

WoodMart theme for WordPress, versions up to and including 8.2.6
WooCommerce storefronts using the WoodMart theme with virtual or downloadable products enabled
Sites relying on WoodMart's AJAX cart update handler (woodmart_update_cart_item)

Discovery Timeline

2025-07-26 - CVE-2025-8097 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8097

Vulnerability Analysis

The WoodMart theme exposes a cart update handler that accepts a qty parameter from HTTP requests without enforcing integer typing or a minimum positive threshold. WooCommerce calculates line totals by multiplying product price by the supplied quantity. When an attacker submits a very small fractional value, the product of price and quantity becomes a sub-cent value that WooCommerce rounds to $0.00 during total calculation.

Because the checkout process treats a zero-total order as fully paid, gateway processing is skipped. For virtual or downloadable goods, the platform then grants immediate access, license keys, or download URLs. The vulnerability requires no authentication and no user interaction on the victim side, and it is exploitable across the network against any storefront running the vulnerable theme.

Root Cause

The root cause is missing input validation in the woodmart_update_cart_item function. The handler accepts arbitrary numeric input for qty and does not reject non-integer or sub-unit values before persisting the cart item. Downstream price calculations then propagate the fractional multiplier, producing rounding-driven zero totals that the checkout flow treats as legitimate.

Attack Vector

An attacker adds a virtual or downloadable product to a cart, then issues an AJAX request to the WoodMart cart update endpoint with a qty value such as 0.00001. The theme accepts the fractional value, WooCommerce computes a rounded total of $0.00, and the attacker proceeds through checkout. Because no payment gateway is invoked for a zero total, the order is marked complete and the fulfillment mechanism releases the digital asset to the attacker. No verified public proof-of-concept code has been published; see the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-8097

Indicators of Compromise

Completed WooCommerce orders with a total of $0.00 that include priced virtual or downloadable products.
Cart or order line items with non-integer quantity values such as 0.00001, 0.0001, or other sub-unit fractions.
Access log entries showing POST requests to WoodMart AJAX cart endpoints containing a fractional qty parameter.
Unusual spikes in download link generation or license key issuance without corresponding gateway transactions.

Detection Strategies

Query the WooCommerce order database for orders where _order_total equals 0 and line items reference priced products.
Inspect webserver access logs for AJAX requests to WoodMart cart handlers containing decimal qty values.
Correlate order fulfillment events (download grants, license emails) against payment gateway transaction records to surface mismatches.

Monitoring Recommendations

Enable verbose logging on WooCommerce checkout and order status transitions to capture quantity and total values.
Alert on any completed order with a non-zero product price and a $0.00 total.
Monitor edits to wp-content/themes/woodmart/ files to detect tampering or unpatched deployments.

How to Mitigate CVE-2025-8097

Immediate Actions Required

Update the WoodMart theme to a version released after 8.2.6 that addresses the qty validation flaw.
Audit recent orders for $0.00 totals tied to priced virtual or downloadable products, and revoke any improperly issued downloads or licenses.
Temporarily disable automatic fulfillment for virtual and downloadable products until the patch is applied.

Patch Information

The vendor distributes WoodMart via ThemeForest. Administrators should update to the latest release available on the ThemeForest Product Page. Refer to the Wordfence Vulnerability Report for the fixed version reference.

Workarounds

Add a server-side filter that rejects cart updates where qty is not a positive integer greater than or equal to 1.
Configure WooCommerce to block checkout completion on orders with a total of $0.00 when the cart contains priced items.
Deploy a web application firewall rule to strip or reject fractional qty parameters submitted to WoodMart AJAX endpoints.

bash

# Example WooCommerce filter to enforce integer cart quantities
add_filter( 'woocommerce_stock_amount', 'intval' );
add_filter( 'woocommerce_quantity_input_args', function( $args ) {
    $args['min_value'] = 1;
    $args['step']      = 1;
    return $args;
} );