PT-2025-42236
CVE-2025-6042
·
Published
2025-10-14
·
Updated
2025-10-15
Description by
CVSS 3.1
7.3
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions
Lisfinity Core plugin versions prior to 1.4.1
Description
The Lisfinity Core plugin for the pebas® Lisfinity WordPress theme is susceptible to privilege escalation. This is a result of the plugin assigning the editor role by default without restricting API usage. This issue can be combined with another to gain administrator privileges.
Recommendations
Update the Lisfinity Core plugin to version 1.4.1 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾