Privilege Escalation Vulnerability in Lisfinity Core Plugin for WordPress

CVE-2025-6038

What is CVE-2025-6038?

The Lisfinity Core plugin, associated with the Lisfinity WordPress theme, presents a vulnerability that allows authenticated attackers with Subscriber-level access and higher to manipulate user passwords without proper identity validation. This security flaw can enable attackers to change passwords of any user, including administrators, posing a significant threat to user account integrity and administrative control. It is crucial for users of versions up to 1.4.0 to implement corrective measures to safeguard against potential attacks.

References