CVE-2025-2798

CRITICAL

Woffice CRM <= 5.4.21 - Unauthenticated Authentication Bypass via Custom Login Form

Title source: llm
STIX 2.1

Description

The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being used. This can be combined with CVE-2025-2797 to bypass the user approval process if an Administrator can be tricked into taking an action such as clicking a link.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0062
EPSS Percentile 44.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-269
Status published
Products (2)
xtendify/woffice < 5.4.22
XTENDIFY/Woffice CRM < 5.4.21
Published Apr 04, 2025
Tracked Since Feb 18, 2026