Insecure Direct Object References (IDOR) allow an attacker to provide user‑controlled keys and access or alter objects that should be protected. This is an Authorization Bypass classified as CWE‑639. If exploited it can let an attacker view or modify data beyond the intended scope, compromising confidentiality, integrity, or availability of the affected resources.

WofficeIO’s Woffice Core WordPress plugin is affected. Any release of the plugin version 5.4.30 or earlier is vulnerable, including new installations that have not upgraded past that point.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1 % suggests a relatively low probability of exploitation. Based on the description, it is inferred that the likely attack vector is network‑based, requiring a remote web request that supplies arbitrary identifiers. The plugin is not catalogued in CISA’s KEV, but administrators should monitor for signs of unauthorized access.