CVE-2025-4631 Missing authorization in The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis
Unauthenticated attackers can escalate privileges to administrator by exploiting a missing capability check in the Profitori WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4631?
CVE-2025-4631 is a critical missing authorization vulnerability in unitybusinesstechnology The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis, published on 31 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated attackers to write arbitrary strings straight into the user’s wp_capabilities meta field, potentially elevating the privileges of an existing user account or a newly created one to that of an administrator.
Weakness: CWE-285
Which versions are affected by CVE-2025-4631?
How do I fix CVE-2025-4631?
No fix has been published for CVE-2025-4631 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-4631 being exploited?
There is no known exploitation of CVE-2025-4631 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-2qf8-5w74-42q7.