CVE-2025-68869

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68869", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-24T14:00:24.760Z", "datePublished": "2026-01-22T16:52:10.526Z", "dateUpdated": "2026-04-28T20:05:24.890Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "lazytasks-project-task-management", "product": "LazyTasks", "vendor": "LazyCoders LLC", "versions": [{"changes": [{"at": "1.3.01", "status": "unaffected"}], "lessThanOrEqual": "1.2.37", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "0xd4rk5id3 | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:03:08.874Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.<p>This issue affects LazyTasks: from n/a through <= 1.2.37.</p>"}], "value": "Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:32.047Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/lazytasks-project-task-management/vulnerability/wordpress-lazytasks-plugin-1-2-37-privilege-escalation-vulnerability?_s_id=cve"}], "title": "WordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T15:22:32.581025Z", "id": "CVE-2025-68869", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T20:05:24.890Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-68869", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-28T15:22:32.581025Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:22:53.272Z"}}], "cna": {"title": "WordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "0xd4rk5id3 | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "affected": [{"vendor": "LazyCoders LLC", "product": "LazyTasks", "versions": [{"status": "affected", "changes": [{"at": "1.3.01", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.2.37"}], "packageName": "lazytasks-project-task-management", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:03:08.874Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/lazytasks-project-task-management/vulnerability/wordpress-lazytasks-plugin-1-2-37-privilege-escalation-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.<p>This issue affects LazyTasks: from n/a through <= 1.2.37.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T14:12:30.838Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68869", "state": "PUBLISHED", "dateUpdated": "2026-04-02T15:23:14.501Z", "dateReserved": "2025-12-24T14:00:24.760Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-22T16:52:10.526Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "lazytasks-project-task-management", "product": "LazyTasks", "vendor": "LazyCoders LLC", "versions": [{"changes": [{"at": "1.3.01", "status": "unaffected"}], "lessThanOrEqual": "1.2.37", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37."}, {"lang": "es", "value": "Vulnerabilidad de Asignaci\u00f3n Incorrecta de Privilegios en LazyCoders LLC LazyTasks lazytasks-project-task-management permite la escalada de privilegios. Este problema afecta a LazyTasks: desde n/d hasta &lt;= 1.4.01."}], "id": "CVE-2025-68869", "lastModified": "2026-06-17T09:59:44.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68869", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T15:22:32.581025Z", "version": "2.0.3"}}]}, "published": "2026-01-22T17:16:12.293", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/lazytasks-project-task-management/vulnerability/wordpress-lazytasks-plugin-1-2-37-privilege-escalation-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T09:49:59.389039+00:00", "value": {"mitigation_remediation": ["Update the LazyTasks plugin to the latest version that removes the privilege assignment flaw.", "If an update is not immediately available, disable or uninstall the plugin from the WordPress installation until a fix is released.", "Verify that all WordPress user accounts adhere strictly to the principle of least privilege, removing any unnecessary administrative roles that the plugin might grant."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The LazyTasks plugin by LazyCoders LLC, used within WordPress sites, is affected for all releases up to and including version 1.2.37. Any WordPress installation that has not updated this plugin remains vulnerable.", "description_and_impact": "An Incorrect Privilege Assignment flaw in the LazyCoders LazyTasks WordPress plugin permits an attacker to elevate their access level. The plugin assigns administrative or higher capabilities without proper validation, enabling a malicious user to gain full control over the site\u2019s content, settings, or user accounts. This vulnerability, classified as CWE-266, threatens confidentiality, integrity, and availability, especially if the attacker exploits an existing account or exploits weak session handling.", "risk_and_exploitability": "Based on the description, the likely attack vector is via crafted HTTP requests targeting the plugin\u2019s endpoints, possibly requiring authenticated access. The CVSS score of 9.8 marks this issue as critical. Although the EPSS score is below 1%, implying a low empirical exploitation probability, the absence from CISA KEV does not reduce the risk for attackers who can reach the plugin\u2019s endpoints\u2014most likely through crafted HTTP requests or authorized user sessions. The privilege escalation potential can result in complete site takeover if the attacker succeeds."}}}}, "created": "2026-01-23T16:30:01.339061+00:00", "updated": "2026-04-28T10:00:06.491694+00:00", "vendors": ["lazycoders", "lazycoders$PRODUCT$lazytasks", "wordpress", "wordpress$PRODUCT$wordpress"]}