The LazyTasks plugin does not properly validate the identity of users calling the REST endpoint wp-json/lazytasks/api/v1/user/role/edit/. An unauthenticated attacker can alter any user’s email address, including that of administrators, and then use the password‑reset mechanism to gain control of the account. Because this allows the attacker to acquire any role within the plugin, it results in a full account takeover. The weakness is an authorization bypass (CWE‑862).

The weakness affects the LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin by lazycoders on WordPress. All versions up to and including 1.2.29 are impacted; users running any of the affected releases with an exposed REST API are vulnerable.

The CVSS base score is 9.8, indicating critical severity. The EPSS score is less than 1 %, suggesting that large numbers of exploits have not been observed yet, and the vulnerability is not listed in the CISA KEV catalog. However, the vulnerability can be exploited remotely over HTTP/HTTPS via the unprotected REST endpoint, which can be accessed by anyone with network connectivity to the WordPress site. An attacker only needs to send a crafted REST request to change the target email address and then trigger the password‑reset flow. If successful, the attacker can assume the target user’s privileges and potentially elevate to administrator access.