CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1.1.0 to 2.2.0. The plugin’s permission callback only verifies that the supplied, encrypted attachment ID maps to an existing attachment post, but does not verify the requester’s identity or capabilities. This makes it possible for unauthenticated attackers to log in as an arbitrary user.
Explanation of Vulnerability in Simple Terms
ONLYOFFICE Docs versions 1.1.0 through 2.2.0 lack proper authorization checks, allowing unauthenticated attackers to read, modify, or delete data without credentials. The vulnerability affects the core document handling functionality and requires only network access to exploit. Organizations using affected versions should update immediately.
What an attacker can do
Read, modify, or delete documents and data without logging in.
Potential impact on your site
Attackers can access, alter, or destroy all documents and data stored in ONLYOFFICE Docs without any credentials.
Conditions required to exploit
Network access to the ONLYOFFICE Docs instance; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
