Home

Description

The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

PUBLISHED Reserved 2025-05-28 | Published 2025-06-28 | Updated 2025-06-30 | Assigner Wordfence




CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

1.0.0 (semver)
affected

Timeline

2025-06-27:Disclosed

Credits

Kenneth Dunn finder

References

www.wordfence.com/...-5bff-4bee-be04-39892c89cd59?source=cve

wordpress.org/plugins/project-notebooks/

plugins.trac.wordpress.org/...e/admin/pto_admin_settings.php

plugins.trac.wordpress.org/...e/admin/pto_admin_settings.php

cve.org (CVE-2025-5304)

nvd.nist.gov (CVE-2025-5304)

Download JSON