Description
The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated attackers to write arbitrary strings straight into the user’s wp_capabilities meta field, potentially elevating the privileges of an existing user account or a newly created one to that of an administrator.
INFO
Published Date :
2025-05-31T06:40:58.133Z
Last Modified :
2025-06-02T15:49:14.554Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2025-4631 vulnerability.
No data.
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-4631.
