CVE-2026-27435: Woffice Auth Bypass Vulnerability

CVE-2026-27435 Overview

CVE-2026-27435 is a Missing Authorization vulnerability [CWE-862] affecting the WofficeIO Woffice WordPress theme. The flaw exists in all versions prior to 5.4.33 and stems from incorrectly configured access control security levels. Unauthenticated attackers can reach functionality that should require valid authorization, leading to limited integrity impact on affected WordPress installations.

The vulnerability is network-accessible, requires no privileges, and needs no user interaction. Woffice is a commercial WordPress theme used for intranet and extranet portals, which typically host internal collaboration data.

Critical Impact
Remote attackers can invoke protected Woffice functionality without authentication, modifying application state on affected WordPress sites running versions before 5.4.33.

Affected Products

WofficeIO Woffice WordPress theme versions prior to 5.4.33
WordPress sites deploying Woffice as an intranet or extranet portal
Any Woffice deployment exposing vulnerable endpoints to the public internet

Discovery Timeline

2026-07-01 - CVE-2026-27435 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-27435

Vulnerability Analysis

CVE-2026-27435 is classified as Missing Authorization [CWE-862]. The Woffice theme exposes functionality whose access control checks are incorrectly configured, allowing callers without proper privileges to invoke protected actions. The issue affects all Woffice releases before version 5.4.33.

Because the attack vector is Network with low complexity and no privileges required, an attacker only needs reachability to the WordPress site. The CVSS impact reflects a limited integrity effect, indicating the attacker can modify a subset of application data or state but cannot directly read confidential content or cause a denial of service through this flaw alone.

EPSS data lists a probability of 0.242% at the 15.2 percentile, indicating low observed exploitation prediction. No public exploit, CISA KEV listing, or in-the-wild activity has been reported at time of publication.

Root Cause

The root cause is an incorrectly configured access control layer within the Woffice theme. Specific request handlers do not enforce the authorization checks required by their sensitivity level. As a result, requests that should be rejected for unauthenticated or low-privilege users are processed as if the caller were authorized. See the Patchstack Woffice Theme Vulnerability advisory for additional technical detail.

Attack Vector

An attacker sends crafted HTTP requests directly to the vulnerable Woffice endpoints on a public WordPress site. No authentication, session, or user interaction is required. The request reaches handler code that omits or misapplies the required capability check, causing the server to execute the protected action and modify affected data. Because the vector is fully remote and unauthenticated, exploitation can be automated across WordPress sites running Woffice versions before 5.4.33.

Detection Methods for CVE-2026-27435

Indicators of Compromise

Unexpected changes to Woffice project, member, event, or content records without corresponding administrator audit entries.
HTTP requests to Woffice theme endpoints originating from unauthenticated sessions or unknown IP addresses.
New or modified user profiles, roles, or membership assignments not initiated by a site administrator.

Detection Strategies

Inventory WordPress installations and identify the Woffice theme version from wp-content/themes/woffice/style.css to flag versions earlier than 5.4.33.
Enable verbose access logging on the WordPress site and search for anonymous POST or GET requests to Woffice AJAX and REST endpoints.
Correlate WordPress database audit logs with web server logs to identify state changes lacking a matching authenticated session.

Monitoring Recommendations

Forward WordPress, PHP, and web server logs to a centralized logging platform and alert on high-volume requests to Woffice endpoints.
Monitor for repeated 200 OK responses to endpoints that would normally return 401 or 403 for unauthenticated callers.
Track WordPress role and capability changes to catch unauthorized privilege modifications.

How to Mitigate CVE-2026-27435

Immediate Actions Required

Upgrade the Woffice theme to version 5.4.33 or later on all WordPress instances.
Audit user accounts, roles, and Woffice content created or modified before the upgrade for signs of tampering.
Restrict administrative and Woffice endpoints behind a web application firewall while the upgrade is scheduled.

Patch Information

The vendor addressed the Missing Authorization issue in Woffice version 5.4.33. Site owners should apply the update through the WordPress theme updater or by replacing theme files with the fixed release. Refer to the Patchstack Woffice Theme Vulnerability entry for advisory tracking.

Workarounds

Block unauthenticated access to Woffice AJAX and REST endpoints at the reverse proxy or web application firewall.
Limit access to the WordPress site to trusted IP ranges until the theme update is deployed.
Temporarily disable public registration and reduce the default role assigned to new users to minimize exposure.

bash

# Example nginx snippet to restrict Woffice endpoints to authenticated sessions
location ~* /wp-admin/admin-ajax.php {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}