{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/profitori-2.0.6.0-2.1.1.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:profitori:profitori:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-4631"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Profitori (2.0.6.0-2.1.1.3)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eProfitori, a WordPress plugin, contains an unauthenticated privilege escalation vulnerability (CVE-2025-4631) affecting versions 2.0.6.0 through 2.1.1.3. The flaw resides in the \u003ccode\u003e/wp-json/stocktend/v1/stocktend_object\u003c/code\u003e REST API endpoint, which fails to perform proper authorization checks. Attackers can interact with this endpoint to directly manipulate the \u003ccode\u003ewp_capabilities\u003c/code\u003e meta field for any existing user ID on the site. By injecting the administrator capability into this field, an unauthorized actor can grant themselves or an existing account full administrative control. A public exploit script has been released, significantly increasing the risk of active exploitation. Organizations using the Profitori plugin are advised to verify their current version immediately.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify WordPress sites running the vulnerable Profitori plugin.\u003c/li\u003e\n\u003cli\u003eAttacker confirms the version by accessing the publicly available \u003ccode\u003e/wp-content/plugins/profitori/readme.txt\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target user ID to compromise via public post author pages or administrative enumeration.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious POST request targeting the REST API endpoint \u003ccode\u003e/wp-json/stocktend/v1/stocktend_object\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request body includes an updated \u003ccode\u003ewp_capabilities\u003c/code\u003e parameter set to grant administrative rights (e.g., \u003ccode\u003ea:1:{s:13:\u0026quot;administrator\u0026quot;;b:1;}\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe vulnerable API endpoint processes the request without validating the attacker's session or permissions.\u003c/li\u003e\n\u003cli\u003eThe target user's meta information is updated in the WordPress database, elevating their role to Administrator.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates as the now-elevated user to gain full control over the WordPress instance.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an unauthenticated attacker full administrative access to the WordPress environment. This level of access typically results in complete system compromise, allowing the attacker to install arbitrary plugins, upload web shells, exfiltrate database contents, and perform further lateral movement within the hosting infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit all WordPress installations to identify if the Profitori plugin is active and running a version below 2.1.1.3.\u003c/li\u003e\n\u003cli\u003eIf identified, disable or remove the Profitori plugin until a vendor-supplied patch is installed.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests targeting the \u003ccode\u003e/wp-json/stocktend/v1/stocktend_object\u003c/code\u003e path.\u003c/li\u003e\n\u003cli\u003eDeploy the included detection rule to monitor for unauthorized API interactions with the plugin's endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T15:02:38Z","date_published":"2026-10-15T15:02:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-profitori-privilege-escalation/","summary":"The Profitori plugin for WordPress, versions 2.0.6.0 through 2.1.1.3, contains a critical vulnerability (CVE-2025-4631) that allows unauthenticated remote attackers to escalate user privileges to Administrator via the REST API.","title":"Unauthenticated Privilege Escalation in Profitori WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-profitori-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Profitori (2.0.6.0-2.1.1.3)","version":"https://jsonfeed.org/version/1.1"}