Privilege Escalation Vulnerability in Lisfinity Core Plugin for WordPress

CVE-2025-6038

What is CVE-2025-6038?

The Lisfinity Core plugin, associated with the Lisfinity WordPress theme, presents a vulnerability that allows authenticated attackers with Subscriber-level access and higher to manipulate user passwords without proper identity validation. This security flaw can enable attackers to change passwords of any user, including administrators, posing a significant threat to user account integrity and administrative control. It is crucial for users of versions up to 1.4.0 to implement corrective measures to safeguard against potential attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References