CVE-2025-2780: Xtendify Woffice Plugin RCE Vulnerability

CVE-2025-2780 Overview

CVE-2025-2780 is an arbitrary file upload vulnerability affecting the Woffice Core plugin for WordPress, used by the Woffice Theme. The flaw resides in the saveFeaturedImage function, which fails to validate uploaded file types. Authenticated attackers with Subscriber-level access or higher can upload arbitrary files to the affected site's server. Successful exploitation may lead to remote code execution on the underlying host. All versions up to and including 5.4.21 are affected, and the vendor addressed the issue in version 5.4.22.

Critical Impact
Low-privileged authenticated users can upload arbitrary files, potentially achieving remote code execution and full compromise of the WordPress site.

Affected Products

Xtendify Woffice Core plugin for WordPress (all versions ≤ 5.4.21)
Woffice Theme for WordPress (which bundles Woffice Core)
WordPress installations running affected Woffice Core versions with Subscriber-level registration enabled

Discovery Timeline

2025-04-04 - CVE-2025-2780 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2780

Vulnerability Analysis

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. The Woffice Core plugin exposes a saveFeaturedImage function intended to attach featured images to content objects within the Woffice workspace. The function processes uploaded files but omits server-side validation of the file extension, MIME type, and content signature.

Because the endpoint is reachable by any authenticated user with at least Subscriber role, the attack surface is broad. WordPress sites that allow open user registration grant attackers a trivial path to obtain the required privilege level. Once a malicious PHP file is uploaded into a web-accessible directory, the attacker can request the file directly and execute arbitrary code under the web server account.

Root Cause

The root cause is missing input validation in the saveFeaturedImage handler. The function accepts uploaded files without verifying that the extension or MIME type matches an allow-list of safe image formats. It also fails to enforce capability checks that would restrict upload functionality to higher-privileged roles.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker authenticates to the target WordPress site as a Subscriber, then sends a crafted HTTP POST request to the Woffice saveFeaturedImage endpoint with a PHP payload disguised or directly named with a .php extension. The server stores the file within the uploads directory. The attacker then requests the uploaded file via HTTP to trigger code execution.

No verified proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-2780

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) inside wp-content/uploads/ or Woffice-specific upload directories
POST requests to Woffice AJAX endpoints invoking saveFeaturedImage originating from Subscriber accounts
New or unfamiliar Subscriber accounts created shortly before suspicious upload activity
Outbound network connections from the PHP-FPM or web server process to attacker-controlled infrastructure

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php referencing the saveFeaturedImage action followed by GET requests to newly created files in upload directories
Run file integrity monitoring against the wp-content/uploads/ tree to alert on creation of files with script extensions
Audit the WordPress users table for recently created low-privilege accounts that subsequently invoked upload actions

Monitoring Recommendations

Enable WordPress audit logging to capture file upload events with associated user IDs and IP addresses
Forward web server, PHP error, and WordPress audit logs to a centralized SIEM for correlation with authentication events
Alert on web server processes spawning shells (sh, bash, nc) or invoking outbound network utilities such as curl or wget

How to Mitigate CVE-2025-2780

Immediate Actions Required

Upgrade the Woffice Core plugin to version 5.4.22 or later as documented in the Woffice Changelog
Disable open user registration or restrict the default new user role to a value below Subscriber where feasible
Audit existing Subscriber accounts and remove any that are unrecognized or inactive
Scan wp-content/uploads/ for files with executable extensions and remove any unauthorized scripts

Patch Information

The vendor released Woffice Core version 5.4.22 on April 1, 2025, which adds file type validation to the saveFeaturedImage function. Site administrators should apply the update through the WordPress plugin manager or by manually replacing the plugin files. Refer to the Woffice Changelog Update for release notes.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests to the saveFeaturedImage action containing non-image file extensions
Configure the web server to deny execution of PHP files within wp-content/uploads/ using directory-level handler restrictions
Restrict access to the Woffice Core plugin endpoints to authenticated administrators while patching is in progress

bash

# Apache: prevent PHP execution inside the WordPress uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}