Privilege Escalation Vulnerability in LC Wizard Plugin for WordPress
CVE-2025-5483

8.1HIGH

Key Information:

Vendor

WordPress
Status
Connector Wizard (formerly Lc Wizard)
Vendor
CVE Published:
7 November 2025

What is CVE-2025-5483?

The LC Wizard plugin for WordPress contains a security flaw that allows unauthenticated users to escalate privileges. Specifically, a missing capability check in the ghl-wizard/inc/wp_user.php file enables unauthorized attackers to create new user accounts with administrative privileges if the PRO feature is activated. This could lead to further exploitation of the site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Connector Wizard (formerly LC Wizard) 1.2.10 <= 1.3.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3366906

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kenneth Dunn
JSON
.