CVE-2025-5304
🗓️ 28 Jun 2025 05:29:51Reported by WordfenceType 
cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 52 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | Exploit for Missing Authorization in Ptoffice Pt_Project_Notebooks | 27 Sep 202502:19 | – | githubexploit |
 | CVE-2025-5304 | 28 Jun 202505:51 | – | circl |
 | WordPress plugin PT Project Notebooks 安全漏洞 | 28 Jun 202500:00 | – | cnnvd |
 | CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function | 28 Jun 202505:29 | – | cvelist |
 | EUVD-2025-19577 | 3 Oct 202520:07 | – | euvd |
 | CVE-2025-5304 | 6 Sep 202602:19 | – | kitploit |
 | CVE-2025-5304 | 28 Jun 202506:15 | – | nvd |
 | CVE-2025-5304 | 28 Jun 202506:15 | – | osv |
 | 📄 WordPress Project Notebooks 1.1.4 Remote Code Execution | 2 Mar 202600:00 | – | packetstorm |
 | WordPress PT Project Notebooks plugin 1.0.0-1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation vulnerability | 27 Jun 202523:09 | – | patchstack |
10
Node
[
{
"vendor": "blafoley",
"product": "PT Project Notebooks – Take Meeting minutes, create budgets, track task management, and more",
"versions": [
{
"version": "1.0.0",
"status": "affected",
"lessThanOrEqual": "1.1.3",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| action | request body | /wp-admin/admin-ajax.php | Privilege escalation/unauthorized admin-like privilege grant via WP ajax endpoint wpnb_pto_new_users_add with missing authorization validation. | CWE-862 |
| nonce | request body | /wp-admin/admin-ajax.php | Privilege escalation/unauthorized admin-like privilege grant via WP ajax endpoint wpnb_pto_new_users_add with missing authorization validation. | CWE-862 |
| ids | request body | /wp-admin/admin-ajax.php | Privilege escalation/unauthorized admin-like privilege grant via WP ajax endpoint wpnb_pto_new_users_add with missing authorization validation. | CWE-862 |
| user_type | request body | /wp-admin/admin-ajax.php | Privilege escalation/unauthorized admin-like privilege grant via WP ajax endpoint wpnb_pto_new_users_add with missing authorization validation. | CWE-862 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 09:47Current
6.6Medium risk
Vulners AI Score6.6
CVSS 3.19.8
EPSS0.00601
SSVC