CVE-2025-2797 Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval

What is CVE-2025-2797?

CVE-2025-2797 is a medium-severity vulnerability in WofficeIO Woffice Core, published on 4 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'woffice_handle_user_approval_actions' function. This makes it possible for unauthenticated attackers to approve registration for any user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2025-2797?

It affects 1 product.

Products include Xtendify Woffice.

How do I fix CVE-2025-2797?

No fix has been published for CVE-2025-2797 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-2797 being exploited?

There is no known exploitation of CVE-2025-2797 in the wild and no public exploit code.

Other vulnerabilities in WofficeIO Woffice Core

• CVE-2025-2798 Woffice <= 5.4.21 - Authentication Bypass via Registration Role Critical 9.8
• CVE-2024-43234 WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability Critical 9.8
• CVE-2024-43153 WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability Critical 9.8
• CVE-2025-2780 Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload High 8.8
• CVE-2024-37470 WordPress Woffice Core plugin <= 5.4.8 - Unauthenticated Broken Access Control vulnerability High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xv4w-vgqg-qwrq.