CVE-2025-7694
📋 TL;DR
The Woffice Core WordPress plugin allows authenticated attackers with Contributor-level access or higher to delete arbitrary server files due to insufficient path validation in the woffice_file_manager_delete() function. This vulnerability can lead to remote code execution by deleting critical files like wp-config.php, affecting all versions up to 5.4.26.
💻 Affected Systems
- Woffice Core plugin for WordPress
📦 What is this software?
Woffice by Xtendify
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full server compromise, data loss, or site defacement.
Likely Case
Unauthorized file deletion causing site disruption or data corruption.
If Mitigated
Limited impact if access controls restrict Contributor roles or file permissions are hardened.
🎯 Exploit Status
Exploitation requires authenticated access, but Contributor roles are commonly granted to untrusted users in some setups.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 5.4.26 (check vendor for exact version)
Vendor Advisory: https://hub.woffice.io/woffice/changelog
Restart Required: No
Instructions:
1. Update the Woffice Core plugin to the latest version via WordPress admin panel. 2. Verify the update by checking the plugin version in the installed plugins list.
🔧 Temporary Workarounds
Restrict User Roles
allLimit Contributor-level access to trusted users only to reduce attack surface.
Disable Plugin
allTemporarily deactivate the Woffice Core plugin if not essential, but this may break site functionality.
🧯 If You Can't Patch
- Implement strict file permissions to protect critical files like wp-config.php from deletion.
- Use a web application firewall (WAF) to block malicious requests targeting the vulnerable function.
🔍 How to Verify
Check if Vulnerable:
Check the plugin version in WordPress admin under Plugins > Installed Plugins; if version is 5.4.26 or lower, it is vulnerable.Check Version:
wp plugin list --name=woffice-core --field=version (if WP-CLI is installed)Verify Fix Applied:
After updating, confirm the plugin version is above 5.4.26 and test file deletion functionality with a safe test file.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion requests in WordPress or web server logs, especially from Contributor-level users.
Network Indicators:
- HTTP POST requests to endpoints involving woffice_file_manager_delete with suspicious file paths.
SIEM Query:
Example: source="wordpress.log" AND "woffice_file_manager_delete" AND response_code=200