PT Project Notebooks WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the PT Project Notebooks plugin for WordPress, affecting versions 1.0.0 through 1.1.3. The issue arises from missing authorization in the 'wpnb_pto_new_users_add' function, allowing unauthenticated attackers to elevate their privileges to that of an administrator.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain administrative privileges on the WordPress site.

Reproduction

To reproduce this vulnerability, send a request to the 'wpnb_pto_new_users_add' action via 'admin-ajax.php' without the necessary authorization. This can be done by an unauthenticated user, as the 'wpnb_pto_new_users_add' action is registered for both authenticated and unauthenticated users without proper checks.