Lisfinity WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Lisfinity Core plugin for WordPress, specifically in versions through 1.4.0. This vulnerability allows authenticated users with Subscriber-level access and above to change the passwords of other users, including administrators. The issue arises because the plugin fails to properly verify a user's identity before allowing password updates.

Impact

Exploitation of this vulnerability could lead to unauthorized password changes, allowing attackers to gain access to other users' accounts, including those of administrators.

Remediation

Users are advised to update the Lisfinity Core plugin to version 1.5.0 or later.