Privilege Escalation Vulnerability in ONLYOFFICE Docs Plugin for WordPress

CVE-2025-6380

What is CVE-2025-6380?

The ONLYOFFICE Docs plugin for WordPress presents a security flaw due to inadequate authorization checks within its oo.callback REST endpoint. Affected versions from 1.1.0 to 2.2.0 permit unauthenticated attackers to potentially escalate privileges by leveraging the lack of identity verification in the permission callback. Consequently, attackers may impersonate arbitrary users by simply supplying an encrypted attachment ID, posing a severe risk to user accounts within the WordPress environment.

References