Critical · published July 24, 2025
🚨 Unauthenticated access is the name of the game! The ONLYOFFICE Docs plugin for WordPress lets attackers slip in and impersonate any user with just a simple request. 🔥 This vulnerability is like a hotel that allows anyone to check into any room just by showing a fake ID — no one’s verifying who they truly are before handing over the keys! An attacker could waltz in and execute actions as any user, potentially leading to unauthorized access to sensitive documents or critical settings. This could mean the difference between a secure site and an absolute disaster for your WordPress installation!
This vulnerability is like a hotel that allows anyone to check into any room just by showing a fake ID — no one’s verifying who they truly are before handing over the keys! The vulnerability stems from the plugin's oo.callback REST endpoint, where it only verifies the attachment ID but completely skips checking the identity of the requester. This lack of authorization means anyone can exploit the system without needing to be logged in.
An attacker could waltz in and execute actions as any user, potentially leading to unauthorized access to sensitive documents or critical settings. This could mean the difference between a secure site and an absolute disaster for your WordPress installation! Immediate action is required: Upgrade the ONLYOFFICE Docs plugin to version 2.2.1 or later to patch this vulnerability. Additionally, review user permissions and ensure proper authentication mechanisms are in place across your site. You've got this! With these updates, you'll keep your WordPress site secure and your users safe. 🛡️