CVE-2018-8710

CRITICAL 9.8CVE-2018-8710 · Published 14/03/2018 · updated 17/06/2026

In short

CVE-2018-8710 is a CRITICAL (CVSS 9.8) vulnerability affecting woocommerce products filter (woocommerce-filter).
Chance of exploitation in the next 30 days (EPSS): 4.2%, higher than 91.0% of all vulnerabilities.
Fix: update to 2.2.0 or later.

Package	Affected versions	Patched versions
woocommerce products filter woocommerce-filter	`< 2.2.0`	`2.2.0`

Description

A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.

References

sec-consult.com/en/blog/advisories/arbitrary-shortcode-execution-local-file-inclusion-in-woof-pluginus-net/index.html · Third Party Advisory
wordpress.org/plugins/woocommerce-products-filter · Release Notes
woocommerce-filter.com/update-woocommerce-products-filter-v-2-2-0 · Vendor Advisory

More vulnerabilities in woocommerce products filter

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free