Woffice Core

Woffice Core has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 7 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (29%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Cross-Site Request Forgery (CSRF).

Every one of the 7 issues recorded for Woffice Core has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (4) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Woffice Core vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-2780

Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

7 records


2026-01-05 00:00	Woffice Core <= 5.4.30 - Unauthenticated Insecure Direct Object Reference Woffice Core <= 5.4.30	`CVE-2025-67919`	5.3 Medium	Rafie Muhammad	Yes
2025-11-14 00:00	Woffice Core <= 5.4.30 - Missing Authorization Woffice Core <= 5.4.30	`CVE-2025-67566`	5.3 Medium	Rafie Muhammad	Yes
2025-08-01 00:00	Woffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion Woffice Core <= 5.4.26	`CVE-2025-7694`	6.8 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2025-04-03 00:00	Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval Woffice Core <= 5.4.21	`CVE-2025-2797`	5.4 Medium	Foxyyy	Yes
2025-04-03 00:00	Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload Woffice Core <= 5.4.21	`CVE-2025-2780`	8.8 High	Foxyyy	Yes
2024-07-01 00:00	Woffice Core <= 5.4.8 - Missing Authorization Woffice Core <= 5.4.8	`CVE-2024-37470`	5.3 Medium	Rafie Muhammad	Yes
2024-07-01 00:00	Woffice Core <= 5.4.8 - Reflected Cross-Site Scripting Woffice Core <= 5.4.8	`CVE-2024-37471`	6.1 Medium	Rafie Muhammad	Yes

Showing 1–7 of 7 reports