CVE-2024-37470highCWE-862

CVE-2024-37470: falha de alta gravidade em WofficeIO Woffice Core

WordPress Woffice Core plugin <= 5.4.8 - Unauthenticated Broken Access Control vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Woffice Core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.5%
Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woffice Core: from n/a through 5.4.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Produtos afetados
WofficeIO · Woffice Core
CVEs relacionadas — WofficeIO Woffice Core

No mesmo produto, das mais perigosas para as menos.

CVE-2025-7694MEDIUMWoffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File DeletionEPSS 1.1%CVE-2025-2780HIGHWoffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.8%CVE-2025-67566MEDIUMWordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-67919MEDIUMWordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2024-37471HIGHWordPress Woffice Core plugin <= 5.4.8 - Site Wide Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2797MEDIUMWoffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration ApprovalEPSS 0.1%