CVE-2025-12963

The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the...

CVE-2025-12963

CVE-2025-12963 concerns the LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress. The connected sources confirm a root cause: missing authorization on the REST API endpoint wp-json/lazytasks/api/v1/user/role/edit/ allows unauthenticated users to mo...