CVE-2025-5304

Published: Jun 28, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security@wordfence.com (Secondary)

Description

The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affected (1)

Products: Ptoffice: Pt Project Notebooks

1 product

Pt Project Notebooks

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ptoffice Pt Project Notebooks	From 1.0.0 to 1.1.3

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://plugins.trac.wordpress.org/browser/project-notebooks/tags/1.1.3/includes/structure/admin/pto_admin_settings.php#L233

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/project-notebooks/tags/1.1.3/includes/structure/admin/pto_admin_settings.php#L36

Source: security@wordfence.com

Product

https://wordpress.org/plugins/project-notebooks/#developers

Source: security@wordfence.com

Product

https://www.wordfence.com/threat-intel/vulnerabilities/id/552ec9fc-5bff-4bee-be04-39892c89cd59?source=cve

Source: security@wordfence.com

Third Party Advisory

Timeline

No history available yet.