CVE-2025-62999

Vulnerability

Overview

The Litho Addons WordPress plugin (versions up to and including 3.5) contains a missing authorization vulnerability. The root cause is incorrectly configured access control security levels, which fail to properly enforce authentication or authorization checks for certain functions [1].

Exploitation

Details

This vulnerability is exploitable without requiring authentication. Attackers can send crafted requests to arbitrary endpoints that lack proper permission checks. Such vulnerabilities are frequently leveraged in mass-exploit campaigns, targeting thousands of websites regardless of size or popularity [1].

Impact

Successful exploitation allows unprivileged users to execute actions that should require higher privileges, effectively granting unauthorized access to sensitive functionality. This can lead to data manipulation, privilege escalation, or other malicious activities depending on the affected component.

Mitigation

The vendor has not released a patch for this specific version, but immediate action is recommended: update the Litho Addons plugin to the latest available version. If an update is not possible, contact your hosting provider or web developer for assistance. The vulnerability is listed in the Patchstack database and is actively used in attacks [1].