CVE-2025-12963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12963", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-10T17:09:20.924Z", "datePublished": "2025-12-12T03:20:55.445Z", "dateUpdated": "2026-04-08T17:21:14.233Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:14.233Z"}, "affected": [{"vendor": "lazycoders", "product": "LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.29", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin"}], "title": "LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6998185-0f9b-48ab-9dca-05adf5ae603a?source=cve"}, {"url": "https://wordpress.org/plugins/lazytasks-project-task-management/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-12-11T15:07:57.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T20:36:54.097651Z", "id": "CVE-2025-12963", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T20:50:02.502Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12963", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-18T20:36:54.097651Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T20:37:11.319Z"}}], "cna": {"title": "LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "lazycoders", "product": "LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.2.29"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T15:07:57.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6998185-0f9b-48ab-9dca-05adf5ae603a?source=cve"}, {"url": "https://wordpress.org/plugins/lazytasks-project-task-management/"}], "descriptions": [{"lang": "en", "value": "The LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-12T03:20:55.445Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12963", "state": "PUBLISHED", "dateUpdated": "2025-12-18T20:50:02.502Z", "dateReserved": "2025-11-10T17:09:20.924Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:20:55.445Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart", "vendor": "lazycoders", "versions": [{"lessThanOrEqual": "1.2.29", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin"}, {"lang": "es", "value": "El plugin LazyTasks - Project & Task Management with Collaboration, Kanban and Gantt Chart para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 1.2.29, ambas inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario a trav\u00e9s del endpoint de la API REST wp-json/lazytasks/api/v1/user/role/edit/ antes de actualizar sus detalles, como la direcci\u00f3n de correo electr\u00f3nico. Esto hace posible que atacantes no autenticados cambien direcciones de correo electr\u00f3nico de usuarios arbitrarios, incluidos los administradores, y aprovechen eso para restablecer la contrase\u00f1a del usuario y obtener acceso a su cuenta. Tambi\u00e9n es posible que los atacantes abusen de este endpoint para otorgar a los usuarios acceso a roles adicionales dentro del plugin."}], "id": "CVE-2025-12963", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12963", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-18T20:36:54.097651Z", "version": "2.0.3"}}]}, "published": "2025-12-12T04:15:40.647", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/lazytasks-project-task-management/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6998185-0f9b-48ab-9dca-05adf5ae603a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:24:43.100912+00:00", "value": {"mitigation_remediation": ["Upgrade the LazyTasks plugin to the latest available version, which is expected to address the authorization issue.", "As a fallback, block or restrict unauthenticated access to the wp-json/lazytasks/api/v1/user/role/edit/ endpoint (e.g., via a firewall rule or an access\u2011control plugin).", "If a compromise is suspected, force a password reset and review the email addresses for all WordPress accounts, particularly administrators, to ensure no unauthorized changes have occurred."], "summary": {"action": "Immediate Patch", "impact": "Unrestricted Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The weakness affects the LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart plugin by lazycoders on WordPress. All versions up to and including 1.2.29 are impacted; users running any of the affected releases with an exposed REST API are vulnerable.", "description_and_impact": "The LazyTasks plugin does not properly validate the identity of users calling the REST endpoint wp-json/lazytasks/api/v1/user/role/edit/. An unauthenticated attacker can alter any user\u2019s email address, including that of administrators, and then use the password\u2011reset mechanism to gain control of the account. Because this allows the attacker to acquire any role within the plugin, it results in a full account takeover. The weakness is an authorization bypass (CWE\u2011862).", "risk_and_exploitability": "The CVSS base score is 9.8, indicating critical severity. The EPSS score is less than 1\u2009%, suggesting that large numbers of exploits have not been observed yet, and the vulnerability is not listed in the CISA KEV catalog. However, the vulnerability can be exploited remotely over HTTP/HTTPS via the unprotected REST endpoint, which can be accessed by anyone with network connectivity to the WordPress site. An attacker only needs to send a crafted REST request to change the target email address and then trigger the password\u2011reset flow. If successful, the attacker can assume the target user\u2019s privileges and potentially elevate to administrator access."}}}}, "created": "2025-12-12T08:47:59.370013+00:00", "updated": "2026-04-21T17:30:37.698814+00:00", "vendors": ["lazycoders", "lazycoders$PRODUCT$lazytasks", "wordpress", "wordpress$PRODUCT$wordpress"]}