Description
Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through <= 3.5.
Published: 2025-12-09
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Litho Addons plugin for WordPress contains missing authorization checks, which is a broken access‑control issue (CWE‑862). This flaw allows a user who should not have administrative rights to reach privileged plugin functions and modify settings that influence site appearance and functionality. The potential impact is privilege escalation within the plugin’s scope, enabling unauthorized configuration changes.

Affected Systems

The affected product is the Litho Addons plugin distributed by themezaa. All released versions up to and including 3.5 are vulnerable. Sites that have installed any version of the plugin in that range are susceptible.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be within the WordPress web application, typically requiring interaction with the admin dashboard or an authenticated user context to invoke the vulnerable plugin functions.

Generated by OpenCVE AI on April 29, 2026 at 22:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Litho Addons plugin to a version newer than 3.5 to apply the vendor’s access‑control fix.
  • If an immediate upgrade is not possible, restrict the plugin’s administrative pages so that only users with the Administrator role can access them—this can be done by editing the plugin’s capability checks or by using a role‑management plugin.
  • Disable the Litho Addons plugin entirely until a patched version is available and block external access to its administrative endpoints using web‑server rules or a firewall.

Generated by OpenCVE AI on April 29, 2026 at 22:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through <= 3.4. Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through <= 3.5.
Title WordPress Litho Addons plugin <= 3.4 - Broken Access Control vulnerability WordPress Litho Addons plugin <= 3.5 - Broken Access Control vulnerability

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Wed, 10 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 10 Dec 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 09 Dec 2025 15:00:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through <= 3.4.
Title WordPress Litho Addons plugin <= 3.4 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:08.287Z

Reserved: 2025-10-24T14:25:19.442Z

Link: CVE-2025-62999

cve-icon Vulnrichment

Updated: 2025-12-10T21:47:28.589Z

cve-icon NVD

Status : Deferred

Published: 2025-12-09T16:18:05.360

Modified: 2026-06-17T09:52:46.670

Link: CVE-2025-62999

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T23:00:14Z

Weaknesses