blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2025-2797

MEDIUM 5.4 CVSS 3.1
Published
April 4, 2025
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security@wordfence.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Description

The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'woffice_handle_user_approval_actions' function. This makes it possible for unauthenticated attackers to approve registration for any user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products and versions

  • WofficeIO Woffice Core — Up to and including 5.4.21
  • xtendify woffice — Before 5.4.22

References

  • hub.woffice.io https://hub.woffice.io/woffice/changelog#april-1st-2025-version-5422 Release Notes
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/1665f2d0-899b-4f9b-91b1-e5799c3b4d3d?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record