The Lisfinity Core plugin for the Lisfinity WordPress theme contains a flaw that allows an authenticated user with Subscriber-level access or higher to change the password of any user, including administrators. Because the plugin does not properly validate that the requester is the legitimate account owner before performing the update, an attacker can once logged in elevate privileges, gain control over admin accounts, and potentially compromise the entire site. The underlying weakness is an authorization bypass whereby a user‑controlled value permits modification of sensitive data.

The vulnerability affects installations of the Lisfinity Core plugin used with the pebas"Lisfinity WordPress theme, specifically versions up to and including 1.4.0. Users running these versions are at risk if the plugin remains unpatched.

The CVSS score of 8.8 classifies this as a high‑severity flaw, and the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires authentication; an attacker must first log in with a Subscriber or higher role and then exploit the password‑change endpoint that lacks proper identity verification. Once exploited, the attacker can change any user’s password, enabling full administrative takeover.