CVE-2025-67566

MediumCVSS 5.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

23th percentile - higher than 23% of all known CVEs

Summary

The Woffice Core plugin (woffice-core) by WofficeIO has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.4.30.

Risk Assessment

Unauthorized individuals may gain access to functions or data they should not have, potentially leading to confidentiality and integrity breaches. The organization may suffer financial or reputational damage.

Recommendation

It is recommended to update the Woffice Core plugin to the latest version and implement proper access controls. Also scan the site for unauthorized changes.

Other vulnerabilities in Woffice Core

CVE-2025-67919Medium
Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core (woffice-core) allows exploiting incorrectly configured access control security levels. This issue affects Woffice Core versions up to and including 5.4.30.

Original NVD description (English source)

Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS