{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6745", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-26T18:14:45.464Z", "datePublished": "2025-07-11T07:22:59.718Z", "dateUpdated": "2026-04-08T16:45:39.314Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:39.314Z"}, "affected": [{"vendor": "xTemos", "product": "Woodmart", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}], "title": "WoodMart <= 8.2.5 - Unauthenticated Post Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3408895e-3418-4f70-8b7c-76f6ba899d11?source=cve"}, {"url": "https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-06-27T11:38:40.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-11T16:53:07.980663Z", "id": "CVE-2025-6745", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T16:53:34.662Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6745", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-11T16:53:07.980663Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T16:53:30.437Z"}}], "cna": {"title": "WoodMart <= 8.2.5 - Unauthenticated Post Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "xTemos", "product": "Woodmart", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-27T11:38:40.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3408895e-3418-4f70-8b7c-76f6ba899d11?source=cve"}, {"url": "https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492"}], "descriptions": [{"lang": "en", "value": "The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:39.314Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6745", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:45:39.314Z", "dateReserved": "2025-06-26T18:14:45.464Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-11T07:22:59.718Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}, {"lang": "es", "value": "El complemento WoodMart para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n en todas las versiones hasta la 8.2.5 incluida, a trav\u00e9s de la funci\u00f3n woodmart_get_posts_by_query(), debido a restricciones insuficientes sobre qu\u00e9 publicaciones se pueden incluir. Esto permite que atacantes no autenticados extraigan datos de publicaciones protegidas con contrase\u00f1a, privadas o en borrador a las que no deber\u00edan tener acceso."}], "id": "CVE-2025-6745", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-11T08:15:24.430", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3408895e-3418-4f70-8b7c-76f6ba899d11?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:07:27.382753+00:00", "value": {"mitigation_remediation": ["Upgrade the WoodMart theme to a version newer than 8.2.5 that contains the vendor\u2011provided fix. ", "If an immediate upgrade is not possible, limit access to the woodmart_get_posts_by_query function to authenticated users only \u2013 for example, by protecting the endpoint with WordPress capabilities or server\u2011side access restrictions. ", "Verify that no other installations of the vulnerable theme remain in production, and apply the same host\u2011level or application\u2011level restrictions to any remaining copies until they can be upgraded."], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the xTemos WoodMart WordPress theme, versions 8.2.5 and earlier. Any website running those versions is potentially vulnerable.", "description_and_impact": "The WoodMart theme contains an information exposure flaw in the woodmart_get_posts_by_query() function; the function fails to enforce proper access checks, allowing an unauthenticated user to retrieve the content of password\u2011protected, private, or draft posts. This is a CWE\u2011200 weakness that can leak sensitive post data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% signals that exploitation is unlikely at present, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can provoke the flaw by sending a standard HTTP request to the theme\u2019s front\u2011end endpoints and receive unrestricted post data, meaning the attack is feasible over the network from any host."}}}}, "created": "2025-07-12T23:05:34.379509+00:00", "updated": "2026-04-22T01:15:07.307444+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "xtemos", "xtemos$PRODUCT$woodmart"]}