Privilege Escalation in Lisfinity Core Plugin for WordPress from Lisfinity

CVE-2025-6042

What is CVE-2025-6042?

The Lisfinity Core plugin, part of the Lisfinity WordPress theme, has a vulnerability that allows for privilege escalation in all versions up to and including 1.4.0. By default, this plugin assigns the editor role, which, while imposed with certain limitations regarding capabilities, does not adequately restrict API usage. This flaw can potentially be exploited in conjunction with other vulnerabilities to grant unauthorized admin privileges, putting WordPress sites at significant risk.

References