{"id":"CVE-2025-1233","aliases":["EUVD-2025-9913","GHSA-gr28-46gw-83px"],"status":"published","title":"Lafka Plugin \u003c= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update","description":"The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00254,"percentile":0.17125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-04-05T05:32:13Z","modified":"2026-06-17T08:38:39Z","products":[{"vendor":"althemist","product":"lafka plugin"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/865b87a8-ab8a-4054-9e18-50693023cb96?source=cve"},{"url":"https://themeforest.net/item/lafka-fast-food-restaurant-woocommerce-theme/23969682"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1233"},{"url":"https://github.com/advisories/GHSA-gr28-46gw-83px"}],"sources":{"cve":[{"id":"CVE-2025-1233","title":"Lafka Plugin \u003c= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update","description":"The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.","status":"published","published":"2025-04-05T05:32:13.838Z","modified":"2026-04-08T17:04:46.256Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-9913","description":"The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.","status":"published","published":"2025-04-05T05:32:13Z","modified":"2026-04-08T17:04:46Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:50.724749Z"}],"ghsa":[{"id":"GHSA-gr28-46gw-83px","title":"The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability...","description":"The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.","status":"published","published":"2025-04-05T06:30:20Z","modified":"2025-04-05T06:30:26Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:00:49.48461Z"}],"nvd":[{"id":"CVE-2025-1233","description":"The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.","status":"published","published":"2025-04-05T06:15:39.223Z","modified":"2026-06-17T08:38:39.347Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:59.48027Z"}]}}