CVE-2025-4631

CRITICAL

Profitori WordPress <2.1.1.3 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-4631. PoCs published by Nxploited, Boshe99.

AI-analyzed exploit summary This Python script exploits CVE-2025-4631, an unauthenticated privilege escalation vulnerability in the Profitori WordPress plugin (versions 2.0.6.0 to 2.1.1.3). It manipulates the `wp_capabilities` field via a vulnerable REST API endpoint to escalate a user's privileges to administrator.

Description

The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated attackers to write arbitrary strings straight into the user’s wp_capabilities meta field, potentially elevating the privileges of an existing user account or a newly created one to that of an administrator.

Exploits (2)

nomisec WORKING POC 1 stars
by Nxploited · poc
https://github.com/Nxploited/CVE-2025-4631

This Python script exploits CVE-2025-4631, an unauthenticated privilege escalation vulnerability in the Profitori WordPress plugin (versions 2.0.6.0 to 2.1.1.3). It manipulates the `wp_capabilities` field via a vulnerable REST API endpoint to escalate a user's privileges to administrator.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Profitori WordPress Plugin (versions 2.0.6.0 to 2.1.1.3)
No auth needed
Prerequisites: Target must have the vulnerable Profitori plugin installed · User ID to escalate must exist
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC
by Boshe99 · pythonpoc
https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2025-4631

The repository contains functional exploit code for CVE-2025-4631, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the vulnerability by uploading a file to a vulnerable endpoint and confirming its presence.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin 3DPrint Lite 1.9.1.4
No auth needed
Prerequisites: Vulnerable WordPress plugin installed · Network access to the target
devstral-2 · analyzed Feb 27, 2026 Full analysis →

Scores

CVSS v3 9.8
EPSS 0.0060
EPSS Percentile 43.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-285
Status published
Products (1)
unitybusinesstechnology/The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis 2.0.6.0 - 2.1.1.3
Published May 31, 2025
Tracked Since Feb 18, 2026