Arbitrary File Deletion Vulnerability in Woffice Core Plugin by WordPress
CVE-2025-7694

7.5HIGH

Key Information:

Vendor

WordPress
Status
Woffice Core
Vendor
CVE Published:
2 August 2025

What is CVE-2025-7694?

The Woffice Core plugin for WordPress contains a security flaw due to inadequate file path validation in the woffice_file_manager_delete() function. This vulnerability allows authenticated users with Contributor-level access or higher to delete arbitrary files from the server. A successful exploitation could result in severe consequences, such as remote code execution, if crucial files like wp-config.php are targeted. This issue affects all versions of the Woffice Core plugin up to and including version 5.4.26.

Affected Version(s)

Woffice Core * <= 5.4.26

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://hub.woffice.io/woffice/changelog
https://themeforest.net/item/woffice-intranetextranet-wor...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trương Hữu Phúc (truonghuuphuc)
JSON
.
CVE-2025-7694 : Arbitrary File Deletion Vulnerability in Woffice Core Plugin by WordPress