ByteOS Network

CVE Vulnerability Details :

CVE-2025-13563

PUBLISHED

More Info Official Page

Assigner-Wordfence

Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599

Published At-19 Feb, 2026 | 04:36

Updated At-19 Feb, 2026 | 04:36

▼CVE Numbering Authority (CNA)

Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.

Affected Products

Vendor

BuddhaThemes

Product

Lizza LMS Pro

Default Status

unaffected

Versions

Affected

From * through 1.0.3 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-269	CWE-269 Improper Privilege Management

Type: CWE

CWE ID: CWE-269

Description: CWE-269 Improper Privilege Management

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Credits

finder

Alyudin Nafiie

Timeline

Event	Date
Disclosed	2026-02-18 15:49:30

Event: Disclosed

Date: 2026-02-18 15:49:30

References

Hyperlink	Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/b113f475-3133-4ea3-9152-03bb84d79307?source=cve	N/A
https://themeforest.net/item/lizza-lms-education-wordpress-theme/51057780	N/A

Hyperlink: https://www.wordfence.com/threat-intel/vulnerabilities/id/b113f475-3133-4ea3-9152-03bb84d79307?source=cve

Resource: N/A

Hyperlink: https://themeforest.net/item/lizza-lms-education-wordpress-theme/51057780

Resource: N/A

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References