CVE-2026-39747: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WofficeIO Woffice

CVE-2026-39747 is an SQL Injection vulnerability (CWE-89) in Woffice up to version 5.4.35. It arises from improper neutralization of special elements used in SQL commands within the Subscriber feature. The vulnerability has a CVSS 3.1 score of 8.5, indicating high severity, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and resulting in a confidentiality impact rated high and availability impact rated low. No official patch or vendor advisory is available to confirm remediation status.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely to execute unauthorized SQL commands. The impact includes a high confidentiality breach and a low availability impact. Integrity impact is not indicated. This could lead to unauthorized data disclosure or partial service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Subscriber functionality and monitor for suspicious activity related to SQL injection attempts.