CVE-2026-39747

HighCVSS 8.5

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

A vulnerability in the Woffice theme up to version 5.4.35 allows a user with the Subscriber role to perform SQL injection.

Risk Assessment

An attacker with subscriber privileges can execute malicious SQL queries, potentially leading to data leakage, database modification, or application takeover.

Recommendation

Update the Woffice theme to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Woffice

CVE-2026-27435Medium
Missing Authorization vulnerability in Woffice allows exploiting incorrectly configured access control security levels. This issue affects Woffice versions before 5.4.33.

Original NVD description (English source)

Subscriber SQL Injection in Woffice <= 5.4.35 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS