CVE-2025-6380
Published: 24 July 2025
Summary
CVE-2025-6380 is a critical-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 26.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2025-6380 is a privilege escalation vulnerability in the ONLYOFFICE Docs plugin for WordPress, affecting versions 1.1.0 through 2.2.0. The flaw arises from missing authorization in the oo.callback REST endpoint, where the permission callback only confirms that a supplied encrypted attachment ID maps to an existing attachment post without verifying the requester's identity or capabilities. This CWE-862 (Missing Authorization) issue was published on 2025-07-24.
Unauthenticated attackers can exploit the vulnerability remotely with low attack complexity and no user interaction, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation enables attackers to log in as an arbitrary WordPress user, granting high confidentiality, integrity, and availability impacts.
Advisories and references, including the Wordfence threat intelligence report and plugin source code views, provide details on the vulnerable endpoints in class-onlyoffice-plugin-public.php (line 111) and class-onlyoffice-plugin-callback.php (line 57), along with the plugin's developer page on WordPress.org. Security practitioners should consult these for mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22503
Vulnerability details
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1.1.0 to 2.2.0. The plugin’s permission callback only verifies that the supplied, encrypted attachment ID maps to an…
more
existing attachment post, but does not verify the requester’s identity or capabilities. This makes it possible for unauthenticated attackers to log in as an arbitrary user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in public REST endpoint enables remote unauthenticated exploitation of WordPress plugin for privilege escalation and arbitrary user login.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates enforcement of approved authorizations on the oo.callback REST endpoint to verify requester identity and capabilities, preventing unauthenticated privilege escalation.
Requires identification and authentication of users prior to accessing sensitive endpoints, blocking unauthenticated attackers from logging in as arbitrary WordPress users.
Enforces least privilege to limit the scope of damage from escalated access even if initial authorization checks fail.