CVE-2025-7694
Published: 02 August 2025
Summary
CVE-2025-7694 is a medium-severity Path Traversal (CWE-22) vulnerability in Xtendify Woffice. Its CVSS base score is 6.8 (Medium).
Operationally, ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function. This affects all versions up to and including 5.4.26 and is tracked as CWE-22 with a CVSS 3.1 score of 6.8.
Authenticated attackers with Contributor-level access or higher can exploit the flaw over the network to delete arbitrary files on the server. Successful exploitation can readily result in remote code execution when files such as wp-config.php are removed.
The issue is referenced in the official Woffice changelog and Wordfence threat intelligence entries, which direct users to review those resources for available updates. The associated EPSS score has remained flat at 0.0165 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23419
Vulnerability details
The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26. This makes it possible for authenticated attackers, with Contributor-level access…
more
and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.