CVE-2025-5304: PT Project Notebooks Privilege Escalation

CVE-2025-5304 Overview

The PT Project Notebooks plugin for WordPress contains a critical Privilege Escalation vulnerability due to missing authorization checks in the wpnb_pto_new_users_add() function. This security flaw affects versions 1.0.0 through 1.1.3 of the plugin, allowing unauthenticated attackers to elevate their privileges to administrator level, potentially gaining complete control over affected WordPress installations.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to gain administrator privileges on vulnerable WordPress sites, enabling complete site takeover, data theft, malware injection, and persistent backdoor installation.

Affected Products

• PT Project Notebooks plugin for WordPress versions 1.0.0 through 1.1.3
• WordPress installations running vulnerable versions of the ptoffice pt_project_notebooks plugin

Discovery Timeline

• 2025-06-28 - CVE-2025-5304 published to NVD
• 2025-07-07 - Last updated in NVD database

Technical Details for CVE-2025-5304

Vulnerability Analysis

This vulnerability stems from a missing authorization check in the wpnb_pto_new_users_add() function within the PT Project Notebooks WordPress plugin. The function, located in pto_admin_settings.php, fails to properly verify whether the requesting user has the appropriate permissions before executing privileged operations. This allows any unauthenticated user to invoke the function and create new administrator accounts or modify existing user roles. The network-accessible nature of this vulnerability combined with no authentication requirements makes it particularly dangerous for internet-facing WordPress installations.

Root Cause

The root cause of CVE-2025-5304 is classified under CWE-862 (Missing Authorization). The vulnerable function wpnb_pto_new_users_add() does not implement proper capability checks or nonce verification before performing user management operations. In WordPress plugin development, administrative functions must verify user capabilities using functions like current_user_can() and validate request authenticity with nonce checks. The absence of these security controls in the affected code paths allows unauthorized access to privileged functionality.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can remotely exploit this vulnerability by sending crafted HTTP requests to the WordPress site hosting the vulnerable plugin. The exploitation process involves identifying a WordPress installation using the PT Project Notebooks plugin and then invoking the unprotected wpnb_pto_new_users_add() function to create a new administrator account or escalate an existing user's privileges.

The vulnerable code paths are exposed at:

• pto_admin_settings.php Line 233
• pto_admin_settings.php Line 36

For detailed technical analysis, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-5304

Indicators of Compromise

• Unexpected administrator accounts appearing in the WordPress user database
• Suspicious user creation or role modification events in WordPress logs
• HTTP requests targeting the wpnb_pto_new_users_add AJAX action from unknown sources
• Unusual activity patterns in the wp_users and wp_usermeta database tables

Detection Strategies

• Monitor WordPress AJAX requests for calls to wpnb_pto_new_users_add action, especially from unauthenticated sessions
• Implement Web Application Firewall (WAF) rules to detect and block exploitation attempts targeting this specific function
• Review access logs for POST requests to admin-ajax.php with suspicious action parameters
• Deploy file integrity monitoring to detect unauthorized modifications to the PT Project Notebooks plugin files

Monitoring Recommendations

• Enable comprehensive WordPress audit logging to capture all user creation and role modification events
• Configure alerts for new administrator account creation, especially from unexpected IP addresses
• Implement real-time monitoring of the wp_users table for unauthorized insertions or privilege modifications
• Review web server access logs regularly for patterns consistent with automated exploitation attempts

How to Mitigate CVE-2025-5304

Immediate Actions Required

• Immediately update the PT Project Notebooks plugin to the latest patched version if available
• If no patch is available, deactivate and remove the PT Project Notebooks plugin from all WordPress installations
• Audit all WordPress user accounts for unauthorized administrator accounts and remove any suspicious entries
• Reset passwords for all legitimate administrator accounts as a precautionary measure
• Review WordPress site for signs of compromise including backdoors, malware, or unauthorized modifications

Patch Information

Check the WordPress Project Notebooks Developers page for the latest version information and security updates. Organizations should verify that any updated version includes proper authorization checks in the wpnb_pto_new_users_add() function before deploying. The fix should implement capability checks using WordPress functions like current_user_can('manage_options') and proper nonce verification.

Workarounds

• Deactivate the PT Project Notebooks plugin until an official patch is released
• Implement WAF rules to block requests to the vulnerable AJAX action wpnb_pto_new_users_add
• Restrict access to admin-ajax.php from untrusted IP addresses if feasible for your environment
• Consider implementing additional authentication layers such as IP whitelisting for WordPress admin functionality

# Example: Block vulnerable AJAX action in .htaccess
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{QUERY_STRING} action=wpnb_pto_new_users_add [NC]
    RewriteRule ^ - [F,L]
</IfModule>