CVE-2025-4672: Offsprout Page Builder Privilege Escalation

CVE-2025-4672 Overview

CVE-2025-4672 is a privilege escalation vulnerability in the Offsprout Page Builder plugin for WordPress, affecting versions 2.2.1 through 2.15.2. The flaw resides in an improperly implemented permission_callback() function exposed by the plugin's REST API extensions. Authenticated users with Contributor-level access or above can read, create, update, or delete any user meta value. Attackers abuse this to overwrite their own wp_capabilities field and assign themselves administrator privileges. The weakness maps to [CWE-285] Improper Authorization.

Critical Impact
A Contributor account can take full administrative control of any WordPress site running a vulnerable Offsprout Page Builder release.

Affected Products

Offsprout Page Builder for WordPress version 2.2.1
Offsprout Page Builder for WordPress versions 2.3.0 through 2.15.1
Offsprout Page Builder for WordPress version 2.15.2

Discovery Timeline

2025-05-31 - CVE-2025-4672 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4672

Vulnerability Analysis

The Offsprout Page Builder plugin registers custom REST API routes through the class-offsprout-api-extensions.php file. These routes expose CRUD operations against WordPress user meta records. The plugin defines a permission_callback() function intended to gate access to these endpoints, but the implementation does not enforce a sufficient capability check. Any authenticated request from a Contributor, Author, Editor, or higher role passes the callback. The endpoints then operate on arbitrary user_id and meta_key values supplied by the request body.

Because WordPress stores a user's role inside the wp_capabilities user meta entry, an attacker writes a serialized array such as a:1:{s:13:"administrator";b:1;} against their own user ID. The next authenticated request executes with full administrator capabilities, including plugin installation, theme editing, and arbitrary PHP execution through the admin interface.

Root Cause

The root cause is the missing capability enforcement inside permission_callback(). The callback validates that the requester is logged in but does not verify the edit_users or manage_options capability before allowing meta modifications. WordPress treats a true return value from permission_callback() as full authorization, which is why the registered routes accept any authenticated identity.

Attack Vector

Exploitation requires only a valid low-privileged account. Many WordPress sites allow self-registration at the Subscriber or Contributor level, particularly multi-author blogs and membership sites. The attacker authenticates, obtains a REST nonce, and issues a POST request to the vulnerable endpoint specifying their own user ID and the wp_capabilities meta key. After the response succeeds, the attacker reloads the admin dashboard and operates as a site administrator. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Code Reference for the unpatched code paths.

Detection Methods for CVE-2025-4672

Indicators of Compromise

Unexpected changes to the wp_capabilities value in the wp_usermeta table, particularly for accounts created with low privileges.
New administrator accounts appearing in the WordPress users list without an audit trail in the activity log.
HTTP requests against /wp-json/offsprout/ REST routes carrying meta_key=wp_capabilities payloads.
Plugin or theme installations performed by accounts that were originally Contributor or Author roles.

Detection Strategies

Inspect WordPress access logs for POST or PUT requests to Offsprout REST endpoints originating from non-administrator sessions.
Run database queries comparing the user_registered date and current wp_capabilities for each user to flag role escalations.
Correlate web server telemetry with endpoint process activity using Singularity Endpoint to identify the PHP-FPM or web worker process executing privilege changes.
Hunt across web and authentication logs in Singularity Data Lake for sequences of REST API calls followed by administrator-only actions within the same session.

Monitoring Recommendations

Enable WordPress audit logging plugins to record role and capability changes in real time.
Forward web server, PHP error, and WordPress audit logs to a centralized SIEM for retention and correlation.
Alert on any modification of wp_capabilities outside of approved administrative workflows.

How to Mitigate CVE-2025-4672

Immediate Actions Required

Update Offsprout Page Builder to a release later than 2.15.2 as soon as the vendor publishes a patched version.
Audit the wp_users and wp_usermeta tables for unauthorized administrator role assignments and revert them.
Reset passwords and active sessions for every account that currently holds Contributor-level or higher access.
Disable open user registration and review the default role assigned to new registrations.

Patch Information

The vulnerability is present in Offsprout Page Builder versions 2.2.1 through 2.15.2. Administrators should monitor the WordPress Plugin Developer Page for the fixed release and apply it immediately. The fix must enforce a proper capability check, such as current_user_can( 'edit_users' ), inside permission_callback() for every route that mutates user meta.

Workarounds

Deactivate and remove the Offsprout Page Builder plugin until a patched version is available.
Restrict access to /wp-json/offsprout/ routes through a web application firewall rule that blocks requests from non-administrator sessions.
Apply a custom mu-plugin that overrides the affected REST routes with a stricter permission_callback returning current_user_can( 'manage_options' ).
Limit new user registrations to the Subscriber role and disable REST API access for unauthenticated and low-privileged users where feasible.

bash

# Example WAF rule fragment blocking the vulnerable endpoint for non-admins
SecRule REQUEST_URI "@beginsWith /wp-json/offsprout/" \
  "id:1004672,phase:1,deny,status:403,\
   msg:'Block Offsprout Page Builder user meta route (CVE-2025-4672)',\
   chain"
  SecRule REQUEST_METHOD "@rx ^(POST|PUT|DELETE|PATCH)$"