---
id: CVE-2025-12963
title: >-
  The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt
  Chart plugin for WordPress is vulnerable to privilege escalation via account
  takeover in all versions up to, and including, 1.2.29
summary: >-
  The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt
  Chart plugin for WordPress is vulnerable to privilege escalation via account
  takeover in all versions up to, and including, 1.2.29. This is due to the
  plugin …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
published: '2025-12-12'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T20:10:01.970'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-12963'
references:
  - url: 'https://wordpress.org/plugins/lazytasks-project-task-management/'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/c6998185-0f9b-48ab-9dca-05adf5ae603a?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00362
epssPercentile: 0.27876
ingestedAt: '2026-10-07T20:46:46.873Z'
---

## Overview

The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.