Profitori Vulnerabilities

The The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.1.3. This makes it possible for unauthenticated attackers to perf...

CVSS:

5.3

Affected:

up to 2.1.1.3

Fix:

No patched version reported

Disclosed:

Jul 21, 2025

CVE-2025-52800 on NVD →

The The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrato...

CVSS:

9.8

Affected:

up to 2.1.1.3

Fix:

No patched version reported

Disclosed:

Jul 11, 2025

CVE-2025-52836 on NVD →

The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated a...

CVSS:

9.8

Affected:

2.0.6.0 – 2.1.1.3

Fix:

No patched version reported

Disclosed:

May 30, 2025

CVE-2025-4631 on NVD →