CVE-2025-5483 – LC Wizard 1.2.10 – 1.3.0 – Missing Authorization to Unauthenticated Privilege Escalation

CVE ID : CVE-2025-5483

Published : Nov. 7, 2025, 4:15 a.m. | 1 hour, 14 minutes ago

Description : The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check in the ghl-wizard/inc/wp_user.php file in versions 1.2.10 to 1.3.0. This makes it possible for unauthenticated attackers to create new user accounts with the administrator role when the PRO functionality is enabled.

Severity: 8.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…