CVE-2026-27435: 
WordPress vulnerability analysis and mitigation

CVE-2026-27435 is a Missing Authorization (Broken Access Control) vulnerability in the WofficeIO Woffice WordPress theme that allows unauthenticated network attackers to bypass access control checks and modify data or settings. It affects all versions of the Woffice theme prior to 5.4.33. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on October 13, 2025, and publicly disclosed on June 29, 2026, by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, GitHub Advisory).

The root cause is classified as CWE-862 (Missing Authorization), where the Woffice theme fails to perform proper authorization checks when an actor attempts to access a resource or perform an action, corresponding to OWASP Top 10 category A1: Broken Access Control (Patchstack). The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it automatable at scale. Exploitation involves sending crafted requests to vulnerable endpoints that lack proper authorization or nonce token validation, allowing unprivileged users to execute higher-privileged actions (GitHub Advisory). No public proof-of-concept code has been identified at this time (Feedly).

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized data or settings modifications on affected WordPress sites running the Woffice theme, resulting in a low integrity impact with no confidentiality or availability impact (GitHub Advisory). While the individual impact per site is limited, the vulnerability is automatable and has been noted as suitable for mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of their traffic or popularity (Patchstack).

The primary remediation is to update the Woffice WordPress theme to version 5.4.33 or later, which contains the fix for this broken access control issue (Patchstack). As an interim measure, administrators should review and audit access control configurations in Woffice deployments to ensure proper authorization checks are enforced, and consider implementing network segmentation or a web application firewall (WAF) to limit exposure until patching is completed (Feedly). Site owners unable to update immediately should contact their hosting provider or web developer for assistance.

Wordfence included this vulnerability in its weekly WordPress vulnerability report for the period of June 29 to July 5, 2026, highlighting it among other WordPress security issues (Wordfence Blog). Patchstack, which coordinated the disclosure, classified the vulnerability as low priority with low severity impact and noted it is unlikely to be exploited in targeted attacks, though it acknowledged the potential for mass-exploit campaigns (Patchstack).