CVE-2025-67566: 
WordPress vulnerability analysis and mitigation

CVE-2025-67566 is a Missing Authorization vulnerability in the WofficeIO Woffice Core WordPress plugin (woffice-core) that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects Woffice Core versions from n/a through 5.4.30. The vulnerability was published on December 9, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before granting access to certain functionality or data. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability enables exploitation of incorrectly configured access control security levels within the Woffice Core plugin, which serves as a core component of the Woffice intranet/project management WordPress theme (Feedly).

Successful exploitation results in a low-level confidentiality impact, allowing unauthenticated attackers to access restricted information or functionality that should require proper authorization. There is no direct integrity or availability impact based on the current CVSS assessment. However, depending on what protected resources are exposed, this could lead to unauthorized disclosure of internal intranet data, user information, or project management content hosted on affected WordPress sites (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67566 at this time. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low attack complexity and lack of authentication requirements do lower the barrier for exploitation if a motivated attacker targets this plugin (Feedly).

Users should update the Woffice Core plugin to a version beyond 5.4.30 as soon as a patched release is made available by WofficeIO. In the interim, site administrators should consider restricting access to WordPress installations at the network or web server level (e.g., IP allowlisting for admin and sensitive endpoints) and auditing user roles and access controls within the plugin's settings. Monitoring WordPress access logs for unexpected requests to protected plugin endpoints is also advisable (Patchstack).