Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function
highThe Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission_callback() function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create, update or delete any...
- CVSS:
- 8.8
- Affected:
- 2.2.1 – 2.15.2
- Fix:
- No patched version reported
- Disclosed:
- May 30, 2025