CVE-2025-7694: 
WordPress vulnerability analysis and mitigation

The Woffice Core plugin for WordPress contains an arbitrary file deletion vulnerability (CVE-2025-7694) discovered in July 2025. The vulnerability affects all versions up to and including 5.4.26 due to insufficient file path validation in the woffice_file_manager_delete() function (NVD).

The vulnerability stems from improper validation of file paths in the woffice_file_manager_delete() function. This path traversal vulnerability (CWE-22) allows authenticated attackers with Contributor-level access or higher to delete arbitrary files on the server. The vulnerability has a CVSS v3.1 base score of 6.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H (NVD, Wordfence).

The vulnerability allows authenticated attackers to delete arbitrary files on the server, which can lead to remote code execution if critical files like wp-config.php are deleted. This could result in complete site compromise and unauthorized access to the WordPress installation (NVD).

The vulnerability was patched in version 5.4.27 released on July 29th, 2025. Users are strongly advised to update to this version or later to address the security issue (Woffice Changelog).