CVE-2024-43234

CRITICAL 9.8CVE-2024-43234 · Published 16/12/2024 · updated 17/06/2026

In short

CVE-2024-43234 is a CRITICAL (CVSS 9.8) vulnerability affecting woffice (xtendify).
Chance of exploitation in the next 30 days (EPSS): 0.66%, higher than 51.4% of all vulnerabilities.
Fix: update to 5.4.15 or later.

Package	Affected versions	Patched versions
woffice xtendify	`< 5.4.15`	`5.4.15`

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through <= 5.4.14.

References

patchstack.com/database/Wordpress/Theme/woffice/vulnerability/wordpress-woffice-theme-5-4-14-unauthenticated-account-takeover-vulnerability · Third Party Advisory

More vulnerabilities in woffice

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

woffice

xtendify

< 5.4.15

5.4.15

More vulnerabilities in woffice

See all →