CVE-2025-6038

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6038", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-12T19:54:13.454Z", "datePublished": "2025-10-09T03:23:30.369Z", "dateUpdated": "2026-04-08T17:12:53.508Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:53.508Z"}, "affected": [{"vendor": "pebas", "product": "Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including those of administrators."}], "title": "Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a3cd1c3e-5bb0-4653-8764-2ca38d9a7c77?source=cve"}, {"url": "https://themeforest.net/item/lisfinity-classified-ads-wordpress-theme/26342611"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Alyudin Nafiie"}], "timeline": [{"time": "2025-06-16T14:51:08.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-08T15:16:05.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-09T13:34:17.615930Z", "id": "CVE-2025-6038", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T13:34:25.509Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-09T13:34:17.615930Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T13:34:21.068Z"}}], "cna": {"title": "Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Alyudin Nafiie"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "pebas", "product": "Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-16T14:51:08.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-08T15:16:05.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a3cd1c3e-5bb0-4653-8764-2ca38d9a7c77?source=cve"}, {"url": "https://themeforest.net/item/lisfinity-classified-ads-wordpress-theme/26342611"}], "descriptions": [{"lang": "en", "value": "The Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including those of administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:53.508Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6038", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:12:53.508Z", "dateReserved": "2025-06-12T19:54:13.454Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-09T03:23:30.369Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme", "vendor": "pebas", "versions": [{"lessThanOrEqual": "1.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including those of administrators."}, {"lang": "es", "value": "El plugin Lisfinity Core - Lisfinity Core, utilizado para el plugin del tema de WordPress pebas\u00ae Lisfinity para WordPress, es vulnerable a la escalada de privilegios a trav\u00e9s de la actualizaci\u00f3n de contrase\u00f1a en todas las versiones hasta la 1.4.0, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de actualizar su contrase\u00f1a. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, cambien las contrase\u00f1as de usuarios arbitrarios, incluidas las de los administradores."}], "id": "CVE-2025-6038", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6038", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-09T13:34:17.615930Z", "version": "2.0.3"}}]}, "published": "2025-10-09T04:16:47.823", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/lisfinity-classified-ads-wordpress-theme/26342611"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a3cd1c3e-5bb0-4653-8764-2ca38d9a7c77?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:42:15.662864+00:00", "value": {"mitigation_remediation": ["Upgrade the Lisfinity Core plugin to the latest version if a fix is available; obtain the update directly from the vendor or theme marketplace.", "If an update is not immediately available, limit the plugin\u2019s password\u2011change functionality to administrators only or temporarily disable it for non\u2011admin roles until a patch is applied.", "Apply workflow monitoring and enforce two\u2011factor authentication for all accounts capable of changing passwords to detect and prevent unauthorized changes."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects installations of the Lisfinity Core plugin used with the pebas\"Lisfinity WordPress theme, specifically versions up to and including 1.4.0. Users running these versions are at risk if the plugin remains unpatched.", "description_and_impact": "The Lisfinity Core plugin for the Lisfinity WordPress theme contains a flaw that allows an authenticated user with Subscriber-level access or higher to change the password of any user, including administrators. Because the plugin does not properly validate that the requester is the legitimate account owner before performing the update, an attacker can once logged in elevate privileges, gain control over admin accounts, and potentially compromise the entire site. The underlying weakness is an authorization bypass whereby a user\u2011controlled value permits modification of sensitive data.", "risk_and_exploitability": "The CVSS score of 8.8 classifies this as a high\u2011severity flaw, and the EPSS score of less than 1% indicates a low but non\u2011zero probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires authentication; an attacker must first log in with a Subscriber or higher role and then exploit the password\u2011change endpoint that lacks proper identity verification. Once exploited, the attacker can change any user\u2019s password, enabling full administrative takeover."}}}}, "created": "2025-10-09T12:51:21.842858+00:00", "updated": "2026-04-20T21:45:18.975607+00:00", "vendors": ["pebas", "pebas$PRODUCT$lisfinity_core", "wordpress", "wordpress$PRODUCT$wordpress"]}