PT-2025-42236 · Lisfinity+1 · Lisfinity+1

Alyudin Nafiie · CVE-2025-6042 · Published 2025-10-15 · Updated 2025-10-15

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Lisfinity Core plugin versions prior to 1.4.1

Description The Lisfinity Core plugin for the pebas® Lisfinity WordPress theme is susceptible to privilege escalation. This is a result of the plugin assigning the editor role by default without restricting API usage. This issue can be combined with another to gain administrator privileges.

Recommendations Update the Lisfinity Core plugin to version 1.4.1 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-6042

Affected Products

Lisfinity

Lisfinity Core

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-6042 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/afffd5e2-798b-42b5-b0b9-ac7d6d06edbb?source=cve · Note
• https://t.me/cveNotify/138712 · Telegram Post
• https://twitter.com/CVEnew/status/1978562097534427621 · Twitter Post
• https://themeforest.net/item/lisfinity-classified-ads-wordpress-theme/26342611 · Note