Woffice <= 5.4.21 - Authentication Bypass via Registration Role

The impact of CVE-2025-2798 is severe. Successful exploitation allows an attacker to bypass the standard user registration and approval process, directly obtaining an Administrator account. This grants them full administrative privileges, including the ability to create, modify, and delete users, access sensitive data, and potentially compromise the entire WordPress site. The vulnerability’s effectiveness is amplified when combined with CVE-2025-2797, enabling attackers to bypass user approval entirely if they can trick an administrator into performing a specific action, such as clicking a malicious link. This could lead to complete system takeover and data exfiltration.

Organizations using Woffice CRM, particularly those with custom login forms or relying on the standard user registration process, are at significant risk. Shared hosting environments where multiple WordPress installations share the same server are also vulnerable, as a compromise of one site could potentially impact others. Sites using older, unpatched versions of WordPress are also at increased risk due to potential compatibility issues.

• wordpress / composer / npm:

wp plugin list | grep woffice

• wordpress / composer / npm:

wp plugin update woffice

• wordpress / composer / npm:

grep -r 'excluded_roles' /var/www/html/wp-content/plugins/wooffice-crm/*

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=wooffice_register_user

1. 2025-04-04Disclosure

   disclosure

2. 2025-04-04Patch

   patch

1. Reserviert2025-03-25
2. Veröffentlicht2025-04-04
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-2798 is to immediately upgrade Woffice CRM to version 5.4.22 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Review and restrict access to custom login forms, ensuring proper role exclusion configurations are in place. Implement strict input validation on registration forms to prevent unauthorized role assignments. Monitor WordPress logs for suspicious registration attempts, particularly those associated with Administrator roles. After upgrading, verify the fix by attempting to register a new user with a custom login form and confirming that the user is not automatically assigned the Administrator role.