Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-13563 EUVD-2025-207558GHSA-vjww-2j24-c357

Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation

Published Feb 19, 2026 · Updated Apr 8, 2026 · Assigned by Wordfence

Description

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.

Affected products

VendorProductAffectedFixed
BuddhaThemes Lizza LMS Pro ≤ 1.0.3 —

References