CVE-2025-4631
CRITICALProfitori WordPress <2.1.1.3 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-4631. PoCs published by Nxploited, Boshe99.
AI-analyzed exploit summary This Python script exploits CVE-2025-4631, an unauthenticated privilege escalation vulnerability in the Profitori WordPress plugin (versions 2.0.6.0 to 2.1.1.3). It manipulates the `wp_capabilities` field via a vulnerable REST API endpoint to escalate a user's privileges to administrator.
Description
The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated attackers to write arbitrary strings straight into the user’s wp_capabilities meta field, potentially elevating the privileges of an existing user account or a newly created one to that of an administrator.
Exploits (2)
This Python script exploits CVE-2025-4631, an unauthenticated privilege escalation vulnerability in the Profitori WordPress plugin (versions 2.0.6.0 to 2.1.1.3). It manipulates the `wp_capabilities` field via a vulnerable REST API endpoint to escalate a user's privileges to administrator.
The repository contains functional exploit code for CVE-2025-4631, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the vulnerability by uploading a file to a vulnerable endpoint and confirming its presence.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H