PT-2025-27288 · WordPress · Pt Project Notebooks
Kenneth Dunn
·
Published
2025-06-28
·
Updated
2025-07-07
·
CVE-2025-5304
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
PT Project Notebooks plugin for WordPress versions 1.0.0 through 1.1.3
Description:
The issue is related to missing authorization in the
wpnb pto new users add() function, which allows unauthenticated attackers to elevate their privileges to that of an administrator, resulting in privilege escalation. This enables attackers to gain admin rights.Recommendations:
For versions 1.0.0 through 1.1.3, consider disabling the
wpnb pto new users add() function until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.LPE
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pt Project Notebooks