Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2025-5304 EUVD-2025-19577GHSA-jjx8-42xr-xg34

PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function

Published Jun 28, 2025 · Updated Jun 30, 2025 · Assigned by Wordfence

Vendor: blafoley Product: PT Project Notebooks – Take Meeting minutes, create budgets, track task management, and more Category: Web / CMS

Description

The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affected products

VendorProductAffectedFixed
blafoley PT Project Notebooks – Take Meeting minutes, create budgets, track task management, and more 1.0.0 – ≤ 1.1.3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Nxploited/CVE-2025-5304 ★ 1 · Sep 27, 2025

    PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References