Privilege Escalation in Offsprout Page Builder for WordPress

CVE-2025-4672

What is CVE-2025-4672?

The Offsprout Page Builder plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or above to exploit improper authorization in the permission_callback() function. This flaw permits these users to read, create, update, or delete any user meta, including potentially granting themselves administrator privileges. It affects versions 2.2.1 through 2.15.2, highlighting the importance of securing user permissions within WordPress plugins to prevent unauthorized access and manipulation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References