{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1233", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-11T14:28:37.419Z", "datePublished": "2025-04-05T05:32:13.838Z", "dateUpdated": "2026-04-08T17:04:46.256Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:46.256Z"}, "affected": [{"vendor": "AlThemist", "product": "Lafka Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site."}], "title": "Lafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/865b87a8-ab8a-4054-9e18-50693023cb96?source=cve"}, {"url": "https://themeforest.net/item/lafka-fast-food-restaurant-woocommerce-theme/23969682"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-02-11T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-02-11T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-04-04T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-07T13:03:49.250291Z", "id": "CVE-2025-1233", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T14:11:43.301Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1233", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-07T13:03:49.250291Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T13:04:12.648Z"}}], "cna": {"title": "Lafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "AlThemist", "product": "Lafka Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-11T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-02-11T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-04-04T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/865b87a8-ab8a-4054-9e18-50693023cb96?source=cve"}, {"url": "https://themeforest.net/item/lafka-fast-food-restaurant-woocommerce-theme/23969682"}], "descriptions": [{"lang": "en", "value": "The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:46.256Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1233", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:04:46.256Z", "dateReserved": "2025-02-11T14:28:37.419Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-05T05:32:13.838Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site."}, {"lang": "es", "value": "El complemento Lafka para WordPress es vulnerable a accesos no autorizados debido a la falta de comprobaci\u00f3n de la funci\u00f3n AJAX \u00ablafka_options_upload\u00bb en todas las versiones hasta la 7.1.0 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, actualicen la opci\u00f3n del tema que anula el sitio."}], "id": "CVE-2025-1233", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-04-05T06:15:39.223", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/lafka-fast-food-restaurant-woocommerce-theme/23969682"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/865b87a8-ab8a-4054-9e18-50693023cb96?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:26:45.165483+00:00", "value": {"mitigation_remediation": ["Upgrade Lafka Plugin to a version newer than 7.1.0, which eliminates the missing capability check.", "If an upgrade cannot be performed immediately, add a capability check so that only users with the edit_theme_options capability can reach the lafka_options_upload action.", "Revoke the edit_theme_options capability from the subscriber role so that only administrators can modify theme settings."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Theme Modification"}, "threat_synthesis": {"affected_systems": "AlThemist\u2019s Lafka Plugin versions up to and including 7.1.0 installed on WordPress sites are affected, with the vulnerability present in all earlier releases.", "description_and_impact": "The Lafka Plugin for WordPress contains a missing capability check on the lafka_options_upload AJAX handler. Any authenticated user with subscriber-level access and above can invoke this endpoint and update theme options that override the site configuration. This privilege escalation allows an attacker to alter the appearance and behavior of the website, potentially injecting malicious content or causing defacement without administrator rights.", "risk_and_exploitability": "The CVSS score of 4.3 signifies moderate severity. The EPSS score below 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated WordPress login with subscriber or higher privileges and direct access to the vulnerable AJAX endpoint."}}}}, "created": "2025-06-23T09:16:30.026752+00:00", "updated": "2026-04-21T21:30:45.746965+00:00", "vendors": ["althemist", "althemist$PRODUCT$lafka_plugin"]}