Vulnerability Description
The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'woffice_handle_user_approval_actions' function. This makes it possible for unauthenticated attackers to approve registration for any user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xtendify | Woffice | < 5.4.22 |
Related Weaknesses (CWE)
References
- https://hub.woffice.io/woffice/changelog#april-1st-2025-version-5422Release Notes
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1665f2d0-899b-4f9b-91bThird Party Advisory
FAQ
What is CVE-2025-2797?
CVE-2025-2797 is a vulnerability with a CVSS score of 5.4 (MEDIUM). The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'woffice_han...
How severe is CVE-2025-2797?
CVE-2025-2797 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-2797?
Check the references section above for vendor advisories and patch information. Affected products include: Xtendify Woffice.