Privilege Escalation in Offsprout Page Builder for WordPress

CVE-2025-4672

What is CVE-2025-4672?

The Offsprout Page Builder plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or above to exploit improper authorization in the permission_callback() function. This flaw permits these users to read, create, update, or delete any user meta, including potentially granting themselves administrator privileges. It affects versions 2.2.1 through 2.15.2, highlighting the importance of securing user permissions within WordPress plugins to prevent unauthorized access and manipulation.

References