CVE-2025-12963

🗓️ 12 Dec 2025 03:20:55Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 15 Views🌐 WEB

Unauthenticated privilege escalation in LazyTasks up to 1.2.29 enabling email changes and role grants.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12963	12 Dec 202504:34	–	circl
CNNVD	WordPress plugin LazyTasks 安全漏洞	12 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-12963 LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalation	12 Dec 202503:20	–	cvelist
EUVD	EUVD-2025-202972	12 Dec 202506:31	–	euvd
NVD	CVE-2025-12963	12 Dec 202504:15	–	nvd
Patchstack	WordPress LazyTasks plugin <= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalation vulnerability	31 Dec 202500:00	–	patchstack
Positive Technologies	PT-2025-50812	12 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12963	13 Dec 202503:59	–	redhatcve
Vulnrichment	CVE-2025-12963 LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalation	12 Dec 202503:20	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 8, 2025 to December 14, 2025)	19 Dec 202517:57	–	wordfence

Vulners

Node

lazycoders lazytasks_project_&_task_management_with_collaboration,_kanban_and_gantt_chartRange≤1.2.29wordpress

[
  {
    "vendor": "lazycoders",
    "product": "LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.29",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c6998185-0f9b-48ab-9dca-05adf5ae603a
wordpress	www.wordpress.org/plugins/lazytasks-project-task-management/

Parameter	Position	Path	Description	CWE
email	request body	wp-json/lazytasks/api/v1/user/role/edit/	Unauthenticated attacker can misuse the REST endpoint to update arbitrary user details (e.g., email) and potentially take over accounts or grant additional roles.	CWE-862
user_id	request body	wp-json/lazytasks/api/v1/user/role/edit/	Unauthenticated attacker can misuse the REST endpoint to update arbitrary user details (e.g., email) and potentially take over accounts or grant additional roles.	CWE-862
role	request body	wp-json/lazytasks/api/v1/user/role/edit/	Unauthenticated attacker can misuse the REST endpoint to update arbitrary user details (e.g., email) and potentially take over accounts or grant additional roles.	CWE-862

15 Apr 2026 00:35Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.19.8

EPSS0.0021

SSVC

CWE-862