PT-2025-50812 · WordPress · Lazytasks

Athiwat Tiprasaharn · Published 2025-12-12 · Updated 2025-12-17 · CVE-2025-12963

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress versions prior to 1.2.30

Description The LazyTasks plugin for WordPress does not properly validate a user's identity before allowing updates to user details. This allows unauthenticated attackers to modify arbitrary user email addresses, including those of administrators, through the /wp-json/lazytasks/api/v1/user/role/edit/ API endpoint. By changing the email address, attackers can reset the user's password and gain access to their account. Attackers can also abuse this endpoint to grant users additional roles within the plugin.

Recommendations Update the LazyTasks plugin to version 1.2.30 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12963

Affected Products

Lazytasks

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12963 · Security Note
• https://twitter.com/cracbot/status/2001246038473265546 · Twitter Post
• https://twitter.com/0dayPublishing/status/1999323451215995084 · Twitter Post
• https://twitter.com/CveFindCom/status/1999338382934094316 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c6998185-0f9b-48ab-9dca-05adf5ae603a?source=cve · Note
• https://wordpress.org/plugins/lazytasks-project-task-management · Note