CVE Intelligence
Analysis AI-assisted

CVE-2025-13563: Lizza LMS Pro for WordPress - Privilege Escalation via Unrestricted User Role Registration

CVE-2025-13563 affects the Lizza LMS Pro plugin for WordPress in all versions up to and including 1.0.3. Its registration function does not restrict which user roles can be selected, which may allow an unauthenticated attacker to register with administrator rights. The CNA, Wordfence, scored the issue critical with a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-13563 is a privilege escalation flaw in the Lizza LMS Pro plugin for WordPress, classified as CWE-269 (Improper Privilege Management). According to the record, the registration function does not restrict which user roles a new account can request. The product page is listed as ThemeForest Lizza LMS Education WordPress Theme.

Impact

  • The record states that an unauthenticated attacker could gain administrator access to the affected site.
  • The CVSS 3.1 vector indicates network reachability, low attack complexity, no privileges required and no user interaction, with high impact to confidentiality, integrity and availability.

Affected products and versions

  • Product: Lizza LMS Pro plugin for WordPress.
  • Versions: all versions up to and including 1.0.3, according to the description.
  • The structured affected and fixes fields in the record are empty, so no fixed version is listed in the sources consulted.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.0039 with a percentile of 0.31295, which is a model estimate and not evidence of observed activity.

Remediation and mitigation

  • Check whether the Lizza LMS Pro plugin is installed and which version is active on each WordPress site.
  • Because no fixed version is listed in the record, consult the vendor and the Wordfence advisory for current guidance.
  • If the plugin is not essential and no vendor update is confirmed, consider deactivating or removing it.
  • Review public registration settings and default role assignments so that new accounts cannot receive elevated roles.

Detection guidance

  • Review recently created user accounts and look for unexpected administrator role assignments.
  • Compare the current administrator list with known staff and investigate or reset credentials for unrecognized accounts.
  • Monitor registration activity for unusual volume or patterns, and review web server and authentication logs for the same period.

Limitations of the available information

  • The record has no title, no structured affected or fixed version data, and no vendor patch reference.
  • The sources do not describe the exact conditions of exploitation, so this analysis does not characterize them.
  • The record shows a source status of Deferred, so it is unclear whether further analysis is pending.

Frequently asked questions

What is CVE-2025-13563?

It is a privilege escalation vulnerability in the Lizza LMS Pro plugin for WordPress, affecting all versions up to and including 1.0.3. The registration function does not restrict which user roles can be assigned.

Is this vulnerability being actively exploited?

This CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted. The EPSS score is a model estimate, not evidence of exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.