CVE-2025-4631

CRITICAL

Profitori WordPress <2.1.1.3 - Privilege Escalation

Title source: llm

Description

The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated attackers to write arbitrary strings straight into the user’s wp_capabilities meta field, potentially elevating the privileges of an existing user account or a newly created one to that of an administrator.

Exploits (2)

nomisec WORKING POC 1 stars
by Nxploited · poc
https://github.com/Nxploited/CVE-2025-4631
github WORKING POC
by Boshe99 · pythonpoc
https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2025-4631

References (6)

Scores

CVSS v3 9.8
EPSS 0.0111
EPSS Percentile 78.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-285
Status published
Products (1)
unitybusinesstechnology/The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis 2.0.6.0 - 2.1.1.3
Published May 31, 2025
Tracked Since Feb 18, 2026