CVE-2024-37470: Xtendify Woffice

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woffice Core: from n/a through 5.4.8.

Affected products

• Xtendify Woffice: before 5.4.9 (fixed in 5.4.9)

Published 2024-11-01. Last modified 2026-06-17.