CVE-2026-39747: WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability

Q: What level of access does an attacker need?

The attack requires low-level privileges. The vulnerability is described as affecting subscribers, indicating that an authenticated subscriber-level account can be sufficient.

Q: Can this be exploited remotely without user interaction?

Yes. The vector is network-based, attack complexity is low, and no user interaction is required.

Q: What is the likely impact of successful exploitation?

Successful exploitation can expose highly sensitive information and has a low availability impact. The supplied severity vector does not indicate an integrity impact.

Q: Which installations should be treated as affected?

WordPress sites using the Woffice theme version 5.4.35 or earlier should be treated as affected.

Published Oct 6, 2026

Updated

Subscriber SQL Injection in Woffice <= 5.4.35 versions.

Affected Software

1 affected component

WordPress Woffice<=5.4.35

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attack requires low-level privileges. The vulnerability is described as affecting subscribers, indicating that an authenticated subscriber-level account can be sufficient.

Can this be exploited remotely without user interaction?

Yes. The vector is network-based, attack complexity is low, and no user interaction is required.

What is the likely impact of successful exploitation?

Successful exploitation can expose highly sensitive information and has a low availability impact. The supplied severity vector does not indicate an integrity impact.

Which installations should be treated as affected?

WordPress sites using the Woffice theme version 5.4.35 or earlier should be treated as affected.

CVE-2026-39747: WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

Can this be exploited remotely without user interaction?

What is the likely impact of successful exploitation?

Which installations should be treated as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Can this be exploited remotely without user interaction?

What is the likely impact of successful exploitation?

Which installations should be treated as affected?