Lisfinity Core - Lisfinity Core Plugin für pebas® Lisfinity WordPress Theme <= 1.4.0 - Nicht authentifizierte Rechteeskalation zu Editor

The core of this vulnerability lies in the plugin's default configuration, which assigns the 'editor' role to users. While some capability limitations are present, the plugin lacks restrictions on API usage. This means an attacker, potentially with limited initial access, can leverage the API to bypass intended security controls. Crucially, this vulnerability can be chained with CVE-2025-6038 to achieve full administrator privileges. Successful exploitation could lead to complete control over the WordPress site, including data modification, deletion, and the installation of malicious code. The blast radius extends to all data and functionality accessible through the compromised WordPress installation.

WordPress sites using the pebas® Lisfinity theme and relying on the Lisfinity Core plugin are at risk. Specifically, sites with default WordPress configurations or those that have not regularly updated their plugins are particularly vulnerable. Shared hosting environments where plugin updates are managed by the hosting provider are also at increased risk.

• wordpress: Use wp-cli plugin list to identify installations of the Lisfinity Core plugin.

wp plugin list --status=active | grep Lisfinity

• wordpress: Check the plugin version using wp plugin list and compare against affected versions (1.0.0–1.4.0).

wp plugin list

• wordpress: Examine WordPress access logs for unusual API requests targeting the Lisfinity Core plugin. Look for patterns indicative of privilege escalation attempts. • generic web: Monitor response headers for unexpected changes or unauthorized access attempts. • generic web: Use curl to test API endpoints exposed by the plugin, looking for vulnerabilities related to privilege escalation.

1. 2025-10-15Disclosure

   Public Disclosure

1. Reserviert2025-06-12
2. Veröffentlicht2025-10-15
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-6042 is to upgrade the Lisfinity Core plugin to a patched version as soon as it becomes available. Until a patch is released, consider restricting API access for users with the 'editor' role. WordPress administrators should review user roles and permissions to ensure that only necessary privileges are granted. Implementing a Web Application Firewall (WAF) with rules to block suspicious API requests targeting the plugin can provide an additional layer of defense. Monitor WordPress logs for unusual API activity or attempts to escalate privileges.