Arbitrary File Deletion Vulnerability in Woffice Core Plugin by WordPress

CVE-2025-7694

What is CVE-2025-7694?

The Woffice Core plugin for WordPress contains a security flaw due to inadequate file path validation in the woffice_file_manager_delete() function. This vulnerability allows authenticated users with Contributor-level access or higher to delete arbitrary files from the server. A successful exploitation could result in severe consequences, such as remote code execution, if crucial files like wp-config.php are targeted. This issue affects all versions of the Woffice Core plugin up to and including version 5.4.26.

References