PT-2025-41355 · WordPress · Lisfinity Core

Alyudin Nafiie · CVE-2025-6038 · Published 2025-10-09 · Updated 2025-10-15

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lisfinity Core plugin for WordPress versions prior to 1.4.1

Description The Lisfinity Core plugin for WordPress is susceptible to privilege escalation. An authenticated attacker with Subscriber-level access or higher can modify passwords for any user, including administrators. This occurs because the plugin does not adequately verify a user’s identity before allowing password updates. The vulnerable component is the password update functionality.

Recommendations Update the Lisfinity Core plugin to version 1.4.1 or later.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-6038

Affected Products

Lisfinity Core

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-6038 · Security Note
• https://twitter.com/CVEnew/status/1976140278785352113 · Twitter Post
• https://t.me/CVEtracker/34506 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a3cd1c3e-5bb0-4653-8764-2ca38d9a7c77?source=cve · Note
• https://twitter.com/CveFindCom/status/1976130448037134413 · Twitter Post
• https://t.me/cveNotify/138712 · Telegram Post
• https://themeforest.net/item/lisfinity-classified-ads-wordpress-theme/26342611 · Note