What is the CVSS score of CVE-2026-23971?

CVE-2026-23971 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Woodmart CVE-2026-23971

Q: Which versions of Woodmart are affected by CVE-2026-23971?

A PHP object injection vulnerability exists in the xtemos WoodMart WordPress theme through version 8.3.8, stemming from insecure deserialization of untrusted data.

EUVD-2026-15544 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-7648-c8fp-vqw5

Deserialization Woodmart

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15544

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.

AnalysisAI

A PHP object injection vulnerability exists in the xtemos WoodMart WordPress theme through version 8.3.8, stemming from insecure deserialization of untrusted data. This vulnerability allows attackers to inject malicious serialized objects that can be instantiated during deserialization, potentially leading to remote code execution or other malicious actions depending on available gadget chains in the WordPress environment. The vulnerability affects all versions of WoodMart up to and including 8.3.8, with no CVSS score or EPSS data currently published, though the underlying deserialization flaw (CWE-502) is a known vector for critical remote exploitation.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a well-established attack vector in PHP applications. WoodMart, identified via CPE (cpe:2.3:a:xtemos:woodmart:*:*:*:*:*:*:*:*), is a WordPress theme that apparently accepts and processes serialized PHP objects without proper validation or sanitization. When user-supplied input containing serialized objects is passed to PHP's unserialize() function or similar deserialization mechanisms, an attacker can craft malicious payloads that instantiate dangerous object classes. If the WordPress environment or theme dependencies expose gadget chains (sequences of object methods that can be chained together), the attacker may achieve arbitrary code execution or data manipulation. This is particularly dangerous in WordPress contexts where themes have broad system access.

RemediationAI

Website administrators running WoodMart should immediately upgrade the theme to a version greater than 8.3.8 (check xtemos official website or WordPress.org theme repository for the latest patched version). Until a patched version is released or installed, implement input validation and filtering on any user-supplied data that might be serialized, disable PHP's unserialize() function if not absolutely required, and consider using JSON-based serialization instead of PHP native serialization. Additionally, restrict WordPress administrative access to trusted IP ranges, implement Web Application Firewall (WAF) rules to detect and block serialized PHP object payloads in requests, and maintain current backups. Consult the vendor advisory at the Patchstack reference link for specific patch availability and timeline. Monitor xtemos official channels and WordPress security mailing lists for patch releases.