Attack Chain

1. Attacker performs reconnaissance to identify WordPress sites running the vulnerable Profitori plugin.
2. Attacker confirms the version by accessing the publicly available /wp-content/plugins/profitori/readme.txt file.
3. Attacker identifies a target user ID to compromise via public post author pages or administrative enumeration.
4. Attacker constructs a malicious POST request targeting the REST API endpoint /wp-json/stocktend/v1/stocktend_object.
5. The request body includes an updated wp_capabilities parameter set to grant administrative rights (e.g., a:1:{s:13:"administrator";b:1;}).
6. The vulnerable API endpoint processes the request without validating the attacker's session or permissions.
7. The target user's meta information is updated in the WordPress database, elevating their role to Administrator.
8. The attacker authenticates as the now-elevated user to gain full control over the WordPress instance.

Impact

Successful exploitation grants an unauthenticated attacker full administrative access to the WordPress environment. This level of access typically results in complete system compromise, allowing the attacker to install arbitrary plugins, upload web shells, exfiltrate database contents, and perform further lateral movement within the hosting infrastructure.

Recommendation

• Immediately audit all WordPress installations to identify if the Profitori plugin is active and running a version below 2.1.1.3.
• If identified, disable or remove the Profitori plugin until a vendor-supplied patch is installed.
• Monitor web server logs for suspicious POST requests targeting the /wp-json/stocktend/v1/stocktend_object path.
• Deploy the included detection rule to monitor for unauthorized API interactions with the plugin's endpoints.