CVE-2025-2798

Summary

CVE-2025-2798: The Woffice CRM theme for WordPress contains an Authentication Bypass vulnerability. This issue arises from a misconfiguration of excluded roles during registration, allowing unauthenticated attackers to register with an Administrator role. This vulnerability is significant because an attacker can exploit it to gain administrative access if a custom login form is in use. Furthermore, it can be exploited in conjunction with CVE-2025-2797 to bypass the user approval process, enabling attackers to create an administrator account without the need for approval from existing administrators.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.