PT-2025-30646 · WordPress · Onlyoffice Docs Plugin For Wordpress

Kenneth Dunn · Published 2025-07-24 · Updated 2025-08-09 · CVE-2025-6380

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Docs plugin for WordPress versions 1.1.0 through 2.2.0

Description The ONLYOFFICE Docs plugin for WordPress is susceptible to a privilege escalation issue due to insufficient authorization checks within the oo.callback REST endpoint. The plugin’s permission callback verifies the existence of an attachment post based on an encrypted attachment ID, but fails to validate the identity or capabilities of the requester. This allows unauthenticated attackers to impersonate arbitrary users.

Recommendations ONLYOFFICE Docs plugin for WordPress version 1.1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.1.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.2.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.3.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.4.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.5.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.6.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.7.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.8.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 1.9.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 2.0.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 2.1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ONLYOFFICE Docs plugin for WordPress version 2.2.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-6380

Affected Products

Onlyoffice Docs Plugin For Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-6380 · Security Note
• https://twitter.com/jmdevlabs/status/1954117405791134003 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/608b0506-074b-4df3-8c30-57cfb090f553?source=cve · Note
• https://twitter.com/CVEnew/status/1948319168534602210 · Twitter Post
• https://plugins.trac.wordpress.org/browser/onlyoffice/tags/2.2.0/public/views/class-onlyoffice-plugin-callback.php#L57 · Note
• https://plugins.trac.wordpress.org/browser/onlyoffice/tags/2.2.0/public/class-onlyoffice-plugin-public.php#L111 · Note
• https://wordpress.org/plugins/onlyoffice/#developers · Note
• https://twitter.com/CveFindCom/status/1948317455303979283 · Twitter Post
• https://twitter.com/cracbot/status/1950149348911960074 · Twitter Post