CVE-2025-4672
Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission_callback() function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create, update or delete any user meta, including flipping their own wp_capabilities to administrator and fully escalate their privileges.
| CWE | CWE-285 |
| Vendor | offsprout |
| Product | offsprout page builder |
| Published | May 31, 2025 |
| Last Updated | Jun 2, 2025 |
Stay Ahead of the Next One
Get instant alerts for offsprout offsprout page builder
Be the first to know when new high vulnerabilities affecting offsprout offsprout page builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
offsprout / Offsprout Page Builder
2.2.1 ≤ 2.15.2
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/9269d18d-8d83-43ff-b777-ba8f58321e9e?source=cve wordpress.org: https://wordpress.org/plugins/offsprout-page-builder/#developers plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/offsprout-page-builder/tags/2.15.2/api/class-offsprout-api-extensions.php#L5 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/offsprout-page-builder/tags/2.15.2/api/class-offsprout-api-extensions.php#L514
Credits
Kenneth Dunn