Arbitrary File Upload Vulnerability in Woffice Core Plugin for WordPress
CVE-2025-2780

8.8HIGH

Key Information:

Vendor

WordPress
Status
Woffice Core
Vendor
CVE Published:
4 April 2025

What is CVE-2025-2780?

The Woffice Core plugin for WordPress has a critical flaw that allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server. This vulnerability stems from inadequate file type validation in the 'saveFeaturedImage' function, present in all versions through 5.4.21. If exploited, this vulnerability could enable attackers to perform remote code execution, potentially jeopardizing the integrity and security of the affected site.

Affected Version(s)

Woffice Core * <= 5.4.21

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://hub.woffice.io/woffice/changelog#april-1st-2025-v...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Friderika Baranyai
.
CVE-2025-2780 : Arbitrary File Upload Vulnerability in Woffice Core Plugin for WordPress