AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2018-8710

CRITICAL · CVSS 9.8 EPSS 4.26% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-03-14 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

Exhibit — Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2018-8710
Severity
CRITICAL
CVSS
9.8
EPSS
4.26%
WordPress

Original Filing — NVD Description

A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.