CVE-2025-6380: ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1.1.0 to 2.2.0. The plugin’s permission callback only verifies that the supplied, encrypted attachment ID maps to an existing attachment post, but does not verify the requester’s identity or capabilities. This makes it possible for unauthenticated attackers to log in as an arbitrary user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6380?
CVE-2025-6380 has a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2025-6380?
To fix CVE-2025-6380, update the ONLYOFFICE Docs plugin to version 2.2.1 or later.
What versions of ONLYOFFICE Docs are affected by CVE-2025-6380?
CVE-2025-6380 affects ONLYOFFICE Docs versions from 1.1.0 to 2.2.0.
What type of vulnerability is CVE-2025-6380?
CVE-2025-6380 is classified as a privilege escalation vulnerability.
What is the cause of CVE-2025-6380?
The cause of CVE-2025-6380 is missing authorization checks within the oo.callback REST endpoint.