{"id":49273,"date":"2025-06-06T10:36:17","date_gmt":"2025-06-06T10:36:17","guid":{"rendered":""},"modified":"2025-10-03T07:08:57","modified_gmt":"2025-10-03T13:08:57","slug":"cve-2025-4672-privilege-escalation-vulnerability-in-offsprout-page-builder-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-4672-privilege-escalation-vulnerability-in-offsprout-page-builder-plugin-for-wordpress\/","title":{"rendered":"CVE-2025-4672: Privilege Escalation Vulnerability in Offsprout Page Builder Plugin for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Offsprout Page Builder plugin for WordPress has been identified as having a significant security vulnerability, specifically a privilege escalation vulnerability. This flaw, designated as CVE-2025-4672, affects versions 2.2.1 to 2.15.2 of the plugin. It allows authenticated attackers with Contributor-level access and above to manipulate user meta, including their own wp_capabilities, thereby escalating their privileges<\/a> to the level of administrator. This vulnerability could potentially lead<\/a> to system compromise or data leakage, posing a serious threat to any WordPress site using the affected versions of the Offsprout plugin.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-4672
\nSeverity: High (CVSS: 8.8)
\nAttack Vector: Network
\nPrivileges Required: Low (Contributor-level access)
\nUser Interaction: Required
\nImpact: System compromise, data leakage<\/a><\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Offsprout Page Builder Plugin for WordPress<\/a> | 2.2.1 to 2.15.2<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of insufficient authorization<\/a> checks in the permission_callback() function of the Offsprout plugin. An attacker with Contributor-level access<\/a> or above is able to send crafted requests that modify the user meta data. This could include changing their own wp_capabilities to that of an administrator, thus allowing them to perform any administrative task on the WordPress site. This includes reading, creating, updating, or deleting any content on the site.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following is a conceptual example of how the vulnerability might be exploited using a crafted HTTP request<\/a> to the vulnerable endpoint.<\/p>\n

POST \/wp-json\/offsprout\/v1\/users\/1 HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\nAuthorization: Bearer [access_token]\n{\n\"meta\": {\n\"wp_capabilities\": {\n\"administrator\": \"1\"\n}\n}\n}<\/code><\/pre>\n
In this example, the attacker sends a POST request<\/a> to the Offsprout endpoint for user updates. The request includes a JSON body that changes the wp_capabilities of the user<\/a> to administrator. This would grant the attacker full administrative privileges on the WordPress<\/a> site.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
To mitigate this vulnerability, users are advised to apply the latest patch provided by the vendor. If a patch is not immediately available, using a Web Application Firewall(WAF) or Intrusion Detection System(IDS) can provide temporary protection by identifying and blocking malicious requests.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Offsprout Page Builder plugin for WordPress has been identified as having a significant security vulnerability, specifically a privilege escalation vulnerability. This flaw, designated as CVE-2025-4672, affects versions 2.2.1 to 2.15.2 of the plugin. It allows authenticated attackers with Contributor-level access and above to manipulate user meta, including their own wp_capabilities, thereby escalating their […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[76],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-49273","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-privilege-escalation"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t