CVE-2025-68043

HIGHNuclei

WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-68043 has a selected CVSS score of 7.3 (high); EIP currently links 1 Nuclei template.

Description

Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 9, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 24, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

LottieFiles

Browse LottieFiles / LottieFiles

Default status: unaffected

CVE ListThrough 3.0.0affected

LottieFiles

Browse LottieFiles / LottieFiles
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHLottieFiles WordPress Plugin <= 3.0.0 - Missing AuthorizationCVSS 7.3

LottieFiles LottieFiles <= 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.

Impact

Attackers can bypass authorization to access or modify restricted resources, potentially leading to data exposure or unauthorized actions.

Remediation

Update to the latest version beyond 3.0.0.

WeaknessesCWE-862
Authorspussycat0x
Template tagscvecve2025wordpresswp-pluginlottiefilesvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/lottiefiles/lottiefiles-300-missing-authorization https://patchstack.com/database/Wordpress/Plugin/lottiefiles/vulnerability/wordpress-lottiefiles-plugin-3-0-0-broken-access-control-vulnerability?_s_id=cve https://plugins.svn.wordpress.org/lottiefiles/

Source: ProjectDiscovery

References

2