CVE-2025-4631

The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated attackers to write arbitrary strings straight into the user’s wp_capabilities meta field, potentially elevating the privileges of an existing user account or a newly created one to that of an administrator.

• CWE-285

• https://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L2675
• https://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L2679
• https://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L2698
• https://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L3673
• https://wordpress.org/plugins/profitori/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c764811f-e9dc-4c3d-b696-5792e70ff0b6?source=cve

Published

May 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46303The issue was addressed with improved bounds checks. This is…5.7
• CVE-2025-46304The issue was addressed with improved bounds checks. This is…5.7
• CVE-2025-46305The issue was addressed with improved bounds checks. This is…5.7
• CVE-2025-46306The issue was addressed with improved bounds checks. This is…5.5
• CVE-2025-46307A logic issue was addressed with improved restrictions. This…5.5
• CVE-2025-46308An authorization issue was addressed with improved state man…5.3
• CVE-2025-46310This issue was addressed through improved state management. …6
• CVE-2025-46311An inconsistent user interface issue was addressed with impr…7.5
• CVE-2025-46313A logging issue was addressed with improved data redaction. …5.5
• CVE-2025-46315A permissions issue was addressed with additional restrictio…7.5
• CVE-2025-46316An out-of-bounds read was addressed with improved input vali…4.3
• CVE-2025-4632Improper limitation of a pathname to a restricted directory …9.8