Woffice CVE-2026-39747

Exploitation requires an authenticated Subscriber-level account on the target WordPress site (per PR:L and the 'Subscriber SQL Injection' description) and the site must run the Woffice theme at version 5.4.35 or earlier. The practical limiting factor is account access: on sites with open/self-registration enabled - common for Woffice's intranet/membership use case - this barrier is minimal, whereas on sites that disable public registration an attacker needs an existing or granted low-privilege account. No user interaction is needed (UI:N) and the attack is remote over the network (AV:N). The exact vulnerable feature, parameter, or endpoint is not specified in the provided data and must be confirmed from the Patchstack advisory.

This is an authenticated SQL injection (CWE-89) in the Woffice WordPress theme at versions <= 5.4.35. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) indicates a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, yielding a base score of 8.5 - elevated by the scope change (S:C) and high confidentiality impact. The critical real-world qualifier, confirmed by both the description and PR:L, is that the attacker must hold a Subscriber-level account, the lowest authenticated WordPress role. On sites that allow open user registration (common for Woffice, which is an intranet/community theme built around member accounts), obtaining a Subscriber account is trivial, effectively lowering the barrier close to unauthenticated. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public evidence of active exploitation or available exploit code; the risk signal here rests on severity and the low privilege prerequisite rather than demonstrated in-the-wild activity. Note a signal to verify: Patchstack's vector asserts S:C (scope change) and A:L (low availability impact), which are atypical for a read-oriented SQL injection - a standard SQLi usually maps to S:U with no availability impact - so the scope/availability metrics should be confirmed against the full vendor advisory. Net assessment: a genuinely serious, patchable flaw that should be prioritized where self-registration is enabled, but not an emergency without exploitation evidence.

An attacker registers (or is granted) a low-privilege Subscriber account on a WordPress site running the Woffice theme at version 5.4.35 or earlier, then sends a crafted request to the vulnerable endpoint with malicious SQL in a parameter. Because the input is concatenated into a database query, the attacker extracts sensitive data such as user credentials, session tokens, or private member content. No public exploit code or active exploitation was identified in the provided data.