Wolmart Vulnerabilities

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Wolmart wolmart allows PHP Local File Inclusion.This issue affects Wolmart: from n/a through <= 1.9.6.

Affected:

up to 1.9.6

Fix:

No patched version reported

Disclosed:

Mar 5, 2026

CVE-2026-22385 on NVD →

The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.6. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Th...

CVSS:

8.1

Affected:

up to 1.9.6

Fix:

No patched version reported

Disclosed:

Feb 25, 2026

CVE-2026-22385 on NVD →

[en] The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes i...

Affected:

up to 1.8.12

Fixed in:

1.8.12

Disclosed:

May 8, 2025

CVE-2024-13793 on NVD →

The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it pos...

CVSS:

7.3

Affected:

up to 1.8.11

Fixed in:

1.8.12

Disclosed:

May 7, 2025

CVE-2024-13793 on NVD →