CVE-2025-5483: LC Wizard Privilege Escalation Vulnerability

CVE-2025-5483 Overview

CVE-2025-5483 is a privilege escalation vulnerability in the LC Wizard plugin for WordPress, affecting versions 1.2.10 through 1.3.0. The flaw resides in the ghl-wizard/inc/wp_user.php file, which fails to perform a capability check before processing user creation requests. Unauthenticated attackers can exploit this missing authorization control to register new accounts with the administrator role when the plugin's PRO functionality is enabled. The issue is tracked under [CWE-862: Missing Authorization].

Critical Impact
Unauthenticated remote attackers can create administrator accounts on affected WordPress sites, leading to full site takeover.

Affected Products

LC Wizard Plugin for WordPress versions 1.2.10 through 1.3.0
WordPress installations with LC Wizard PRO functionality enabled

Discovery Timeline

2025-11-07 - CVE-2025-5483 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-5483

Vulnerability Analysis

The LC Wizard plugin exposes a user creation handler in ghl-wizard/inc/wp_user.php that lacks a capability check. WordPress requires plugins to validate caller permissions using functions such as current_user_can() before performing privileged operations. The affected handler omits this validation, allowing any HTTP client to invoke the endpoint without authentication.

When the plugin's PRO functionality is enabled, the unprotected handler accepts user-supplied parameters and creates a new WordPress account. The role parameter is honored without restriction, so attackers can specify the administrator role. The result is a fully privileged account controlled by the attacker.

Root Cause

The root cause is a missing authorization check on a state-changing function. The plugin treats the user registration logic as publicly accessible rather than restricted to administrators. No nonce verification or role validation gates the operation, leaving the endpoint open to anonymous abuse.

Attack Vector

Exploitation occurs over the network against the WordPress site. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint with parameters specifying a username, password, email, and the administrator role. The server processes the request without authentication and persists the new account. The attacker then logs in through wp-login.php with full administrative privileges, enabling theme and plugin uploads, code execution through PHP files, and database manipulation. Refer to the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-5483

Indicators of Compromise

Unexpected WordPress user accounts with the administrator role created without a corresponding admin action in audit logs.
HTTP POST requests to plugin paths under /wp-content/plugins/ghl-wizard/ originating from unauthenticated sessions.
New wp_users and wp_usermeta rows referencing the administrator capability and recently created timestamps.

Detection Strategies

Monitor WordPress audit logs and the wp_users table for accounts created outside of legitimate administrative workflows.
Inspect web server access logs for requests targeting ghl-wizard/inc/wp_user.php or related plugin endpoints from unauthenticated clients.
Deploy WordPress security plugins or web application firewall rules that flag anonymous user-creation requests.

Monitoring Recommendations

Alert on any creation of accounts with the administrator, editor, or other privileged roles outside change windows.
Track outbound connections from web servers immediately following new admin account creation, which may indicate post-exploitation activity.
Review installed plugin inventories and version numbers regularly to ensure vulnerable LC Wizard versions are not present.

How to Mitigate CVE-2025-5483

Immediate Actions Required

Update the LC Wizard plugin to a version later than 1.3.0 that includes the capability check fix.
Audit all WordPress user accounts and remove unauthorized administrators, then rotate credentials for legitimate admins.
Disable the LC Wizard PRO functionality until the plugin is patched if an upgrade cannot be applied immediately.

Patch Information

The vendor addressed the vulnerability through a code change tracked in the WordPress Changeset Update. The patch introduces an authorization check on the affected user creation handler, blocking unauthenticated callers from invoking the function.

Workarounds

Deactivate and remove the LC Wizard plugin until a patched version can be installed.
Apply web application firewall rules that block unauthenticated POST requests to ghl-wizard/inc/wp_user.php.
Restrict access to /wp-content/plugins/ghl-wizard/ at the web server level using IP allow lists where feasible.

bash

# Example nginx rule blocking external access to the vulnerable endpoint
location ~* /wp-content/plugins/ghl-wizard/inc/wp_user\.php$ {
    deny all;
    return 403;
}