Woffice WordPress theme: SQL injection by subscriber accounts
Summary
The Woffice WordPress theme up to and including 5.4.35 contains an SQL injection flaw (CWE-89). An attacker with a low-privilege subscriber account can read, modify or delete data in the WordPress database, including user accounts and password hashes. No user interaction is required, and no fixed version has been published.
Affected
- Woffice theme up to and including 5.4.35
- Vendor name per CVE record: WofficeIO
Fixed in
Unknown. No fixed version was published at the time of review.
Workaround
- No vendor or Patchstack workaround is known.
- Restrict or disable public self-registration.
- Review existing subscriber accounts for unknown or unused users.
- Consider a web application firewall or virtual patch from your hosting or security provider, if available. Not verified for this CVE.
Exploitation
- Not known to be exploited in the wild. Not listed in CISA KEV in the sources reviewed.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no.
- Patchstack rates it medium priority and expects exploitation.
Our recommendation
- Check whether Woffice is installed and which version is used.
- Prioritise sites up to 5.4.35 that allow open registration or hold personal or customer data.
- Restrict self-registration and review subscriber accounts.
- Apply the vendor fix once published. If none appears, plan a replacement or compensating controls.
- Monitor the Patchstack entry and the vendor changelog, and review web server and database logs for suspicious requests or errors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: Woffice SQL injection (<= 5.4.35) patchstack.com
- HOL Guard: CVE-2026-39747 Woffice SQL injection hol.org
- Strix: CVE-2026-39747 www.strix.ai
- Patchstack: Multiple vulnerabilities patched in Woffice theme patchstack.com
- Patchstack: Woffice vulnerability list patchstack.com
- Wordfence: Woffice vulnerabilities www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:24.
Original description (NVD)
Subscriber SQL Injection in Woffice <= 5.4.35 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.