{"cve":"CVE-2018-8710","nvd":{"published":"2018-03-14T19:29:00.720","modified":"2026-06-17T02:05:16.347","status":"Modified","description":"A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the \"shortcode\" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-287"],"references":["https://sec-consult.com/en/blog/advisories/arbitrary-shortcode-execution-local-file-inclusion-in-woof-pluginus-net/index.html","https://wordpress.org/plugins/woocommerce-products-filter/#developers","https://www.woocommerce-filter.com/update-woocommerce-products-filter-v-2-2-0/","https://sec-consult.com/en/blog/advisories/arbitrary-shortcode-execution-local-file-inclusion-in-woof-pluginus-net/index.html","https://wordpress.org/plugins/woocommerce-products-filter/#developers"],"products":["woocommerce-filter:woocommerce_products_filter"],"source":"nvd","synced_at":"2026-10-19T20:48:50.842038930+00:00"},"epss":{"cve":"CVE-2018-8710","score":0.04179,"percentile":0.90918,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}