CVE-2025-68869
Published: 22 January 2026
Summary
CVE-2025-68869 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the privilege escalation vulnerability by requiring timely remediation through patching the affected LazyTasks plugin versions up to 1.2.37.
Enforces the principle of least privilege to limit the impact and success of unauthorized privilege escalation attempts via the plugin flaw.
Ensures proper management and assignment of account privileges, countering incorrect privilege assignment in the LazyTasks plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation exploit in unauthenticated public-facing WordPress plugin.
NVD Description
Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37.
Deeper analysisAI
CVE-2025-68869 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the LazyTasks WordPress plugin (lazytasks-project-task-management) developed by LazyCoders LLC. This flaw enables privilege escalation and affects all versions of the plugin from its initial release through 1.2.37.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. Unauthenticated attackers can exploit it over the network with low attack complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability via privilege escalation.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lazytasks-project-task-management/vulnerability/wordpress-lazytasks-plugin-1-2-37-privilege-escalation-vulnerability?_s_id=cve.
Details
- CWE(s)