CVE-2025-6380 — AI Deep Analysis Summary

🚨 **Essence**: A critical auth bypass in ONLYOFFICE Docs plugin for WordPress. 📉 **Consequences**: Attackers can log in as *any* user without credentials. Total loss of confidentiality, integrity, and availability.

🛡️ **Root Cause**: **CWE-862** (Missing Authorization). The plugin fails to verify if the user has permission to access specific resources or actions. 🚫 No checks = No protection.

📦 **Affected**: WordPress Plugin **ONLYOFFICE Docs**. 📏 **Versions**: **1.1.0** through **2.2.0**. 🏢 **Vendor**: Onlyoffice. If you use these versions, you are at risk!

💀 **Attacker Capabilities**: ✅ **Privileges**: Arbitrary user login (Admin/User). ✅ **Data**: Full access to sensitive docs. ✅ **Impact**: High (CVSS H/H/H). They can read, modify, or delete anything.

⚡ **Exploitation Threshold**: **LOW**. 🌐 **Network**: Remote (AV:N). 🔑 **Auth**: None required (PR:N). 🖱️ **UI**: None required (UI:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit!

🕵️ **Public Exploit**: **No PoC provided** in the data. 📰 **References**: WordFence and WordPress Trac links exist. ⚠️ **Risk**: Even without a public script, the flaw is simple. Wild exploitation is likely imminent.

🔍 **Self-Check**: 1. Check WordPress Plugins list. 2. Look for **ONLYOFFICE Docs**. 3. Verify version is **≤ 2.2.0**. 4. Scan for the callback endpoint `/public/class-onlyoffice-plugin-public.php`.…

🩹 **Official Fix**: **Yes**. 📅 **Published**: 2025-07-24. 🔄 **Action**: Update to the latest version via WordPress Dashboard. 📝 **Source**: WordPress Plugin Trac confirms the fix path.

🚧 **No Patch Workaround**: 1. **Disable** the plugin immediately. 2. **Remove** ONLYOFFICE Docs from the site. 3. Use alternative document editors. 🛑 Do not leave it active without a fix!

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P1**. CVSS is High impact. Remote, unauthenticated access. Patch **NOW** or disable the plugin. Do not wait!