Privilege Escalation Vulnerability in Profitori Plugin for WordPress
CVE-2025-4631
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 May 2025
What is CVE-2025-4631?
The Profitori plugin for WordPress has a significant vulnerability that enables privilege escalation due to a missing capability check on the 'stocktend_object' endpoint. This flaw affects versions 2.0.6.0 through 2.1.1.3, allowing unauthorized attackers to invoke the 'save_object_as_user()' function. This function writes arbitrary data to the user's 'wp_capabilities' meta field, potentially granting administrative privileges to existing or newly created user accounts. As a result, this poses a substantial security risk, necessitating immediate attention from site administrators.
Affected Version(s)
The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis 2.0.6.0 <= 2.1.1.3