The flaw is a missing or incorrect nonce check in the plugin’s user approval function, which lets an attacker send a forged request to approve any registration. Since the action occurs when an administrator is prompted to click a link or take an action, the vulnerability can bypass the mandatory approval step and create user accounts that bypass the intended approval workflow.

All WordPress sites using Woffice Core up to and including version 5.4.21 are affected. The issue is specific to the WofficeIO Woffice Core plugin.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog and requires social engineering to exploit, as the attacker must convince an administrator to trigger the forged request. If exploited, the attacker could gain unauthorized account creation privileges, potentially leading to further attacks if those accounts are used as footholds.