CVE-2025-7694 is a path traversal vulnerability (CWE-22) in the Woffice Core WordPress plugin's file deletion function (woffice_file_manager_delete()). It allows authenticated users with Contributor privileges or higher to bypass file path restrictions and delete arbitrary files on the server. This improper validation of file paths can result in deletion of critical files, potentially enabling remote code execution. The vulnerability affects all versions up to and including 5.4.26. The CVSS 3.1 base score is 6.8, reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity and availability impact.

Successful exploitation allows authenticated users with Contributor-level access or above to delete arbitrary files on the server hosting the WordPress site. This can disrupt site availability and integrity, and may lead to remote code execution if key files like wp-config.php are deleted. There is no indication of confidentiality impact. The vulnerability poses a medium severity risk based on the CVSS score of 6.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access and above to trusted users only. Monitor for updates from WofficeIO regarding patches or mitigations. Avoid granting unnecessary file deletion permissions to reduce risk.