CVE-2025-2798: Authentication Bypass in Woffice CRM

The impact of this vulnerability is severe. Successful exploitation allows an attacker to bypass the standard user registration and approval process, directly gaining Administrator privileges. This grants them complete control over the Woffice CRM system, including access to sensitive customer data, modification of configurations, and potentially compromise of the entire WordPress installation. The vulnerability's ease of exploitation, combined with the high privileges granted, makes it a significant risk. It's particularly concerning that this can be chained with CVE-2025-2797 to further bypass security measures if an administrator is tricked into taking an action.

1. Reserved2025-03-25
2. Published2025-04-04
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to upgrade Woffice CRM to version 5.4.22 or later, which contains the fix for this authentication bypass. If upgrading immediately is not possible, consider temporarily disabling user registration or implementing stricter role-based access controls. Review existing user accounts for any suspicious Administrator accounts that may have been created without proper authorization. Implement a Web Application Firewall (WAF) rule to block requests attempting to register users with privileged roles. Monitor WordPress logs for unusual registration attempts.