The Lisfinity Core plugin automatically assigns the editor role to users upon installation, while its API calls are not restricted by role. This design flaw allows an attacker to gain editor-level privileges without authentication, particularly when leveraged in conjunction with CVE-2025-6038. The elevated privileges enable modification of site content, addition of new users, and other administrative actions normally reserved for higher roles.

WordPress sites employing the pebas Lisfinity Core plugin for the Lisfinity WordPress theme in any version up to and including 1.4.0. The vulnerability affects the plugin itself, regardless of the broader theme, and impacts any WordPress installation where unauthenticated access to the plugin’s API is possible.

The CVSS score of 7.3 categorizes the issue as medium severity, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. The vulnerability may not be listed in the CISA KEV catalog. It is inferred that the attack vector is unauthenticated via the exposed API endpoints, allowing an external actor to elevate privileges to the editor role without needing prior credentials. Once elevation is achieved, the attacker can perform any action allowed to editors, potentially compromising content integrity and site stability.