CVE-2025-6380: ONLYOFFICE Docs Privilege Escalation Flaw

CVE-2025-6380 Overview

The ONLYOFFICE Docs plugin for WordPress contains a critical privilege escalation vulnerability due to missing authorization controls in its oo.callback REST endpoint. Affecting versions 1.1.0 through 2.2.0, the plugin's permission callback only verifies that the supplied, encrypted attachment ID maps to an existing attachment post, but critically fails to verify the requester's identity or capabilities. This architectural flaw enables unauthenticated attackers to log in as an arbitrary user, including administrators, leading to complete site compromise.

Critical Impact

Unauthenticated attackers can bypass authentication entirely and gain arbitrary user access, including administrator privileges, leading to full WordPress site takeover.

Affected Products

• ONLYOFFICE Docs plugin for WordPress versions 1.1.0 to 2.2.0
• WordPress installations using the vulnerable ONLYOFFICE Docs plugin

Discovery Timeline

• 2025-07-24 - CVE-2025-6380 published to NVD
• 2025-07-25 - Last updated in NVD database

Technical Details for CVE-2025-6380

Vulnerability Analysis

This vulnerability stems from a critical authorization bypass in the ONLYOFFICE Docs plugin's REST API callback mechanism. The oo.callback endpoint, designed to handle document editing callbacks from the ONLYOFFICE Document Server, implements an insufficient permission check that validates only the existence of an encrypted attachment ID rather than authenticating and authorizing the requesting user.

The vulnerability is classified under CWE-862 (Missing Authorization), representing a fundamental security design flaw where authentication controls are entirely absent from a sensitive endpoint. The network-accessible nature of this REST endpoint, combined with the lack of authentication requirements, creates a direct attack path for remote adversaries to achieve privilege escalation without any user interaction.

When exploited, attackers can manipulate the callback mechanism to authenticate as any WordPress user on the system. This includes administrator accounts, granting full control over the WordPress installation including the ability to install malicious plugins, modify content, access sensitive data, and potentially pivot to underlying server infrastructure.

Root Cause

The root cause lies in the plugin's class-onlyoffice-plugin-callback.php file, specifically in how the permission callback validates incoming requests to the oo.callback REST endpoint. The validation logic only checks whether the supplied encrypted attachment ID corresponds to a valid WordPress attachment post. However, it completely omits verification of the requester's identity, session validity, or capability permissions. This missing authorization check allows any unauthenticated request that contains a valid encrypted attachment ID to be processed with elevated privileges.

Attack Vector

The attack vector is network-based, requiring no authentication, no user interaction, and no special privileges. An attacker can exploit this vulnerability by:

1. Identifying a WordPress site running a vulnerable version of the ONLYOFFICE Docs plugin
2. Crafting a malicious request to the oo.callback REST endpoint
3. Supplying a valid encrypted attachment ID (which may be obtained through enumeration or other means)
4. Leveraging the callback mechanism to authenticate as any user, including site administrators

The vulnerability in the callback handler at class-onlyoffice-plugin-callback.php (line 57) processes the request without validating user credentials, allowing the attacker to assume the identity of any WordPress user. Technical details of the vulnerable code can be found in the OnlyOffice Plugin Callback Code and OnlyOffice Plugin Code Reference.

Detection Methods for CVE-2025-6380

Indicators of Compromise

• Unexpected or unauthorized REST API calls to the oo.callback endpoint from external IP addresses
• Anomalous login activity for administrator or privileged user accounts without corresponding legitimate user sessions
• Sudden changes to WordPress site settings, user roles, or installed plugins by accounts that should not have such access
• Web server logs showing repeated POST requests to /wp-json/onlyoffice/callback from suspicious sources

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on unusual traffic patterns to the ONLYOFFICE callback endpoint
• Enable and review WordPress audit logging for authentication events, particularly successful logins without corresponding session creation
• Deploy endpoint detection solutions to identify unauthorized administrative actions following suspicious API activity
• Monitor for plugin file modifications or new plugin installations that occur outside of expected maintenance windows

Monitoring Recommendations

• Configure real-time alerting on authentication events for administrator accounts
• Establish baseline traffic patterns for the ONLYOFFICE plugin endpoints and alert on deviations
• Implement rate limiting on REST API endpoints to slow down enumeration and exploitation attempts
• Review access logs periodically for requests to /wp-json/ endpoints from untrusted sources

How to Mitigate CVE-2025-6380

Immediate Actions Required

• Update the ONLYOFFICE Docs plugin to the latest patched version immediately
• If immediate patching is not possible, temporarily disable the ONLYOFFICE Docs plugin until a secure version can be deployed
• Audit WordPress user accounts for any unauthorized access or privilege changes
• Review server and application logs for indicators of prior exploitation
• Reset passwords for all administrator accounts as a precautionary measure

Patch Information

Organizations should update the ONLYOFFICE Docs plugin to a version newer than 2.2.0 that includes the security fix. The patch should be available through the WordPress Plugin Directory. Administrators should verify the installed version and apply updates through the WordPress admin dashboard or by manually downloading and installing the corrected plugin package.

For detailed vulnerability analysis and remediation guidance, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Disable the ONLYOFFICE Docs plugin entirely until a patched version is available
• Implement IP-based access restrictions to the WordPress REST API, limiting access to trusted networks only
• Deploy a web application firewall (WAF) rule to block unauthenticated requests to the oo.callback endpoint
• Consider temporarily restricting access to the WordPress admin interface to known IP addresses

# Example .htaccess rule to restrict access to the callback endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/onlyoffice/callback
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. 
RewriteRule .* - [F,L]
</IfModule>