What the vulnerability does
01Description
The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin
Explanation of Vulnerability in Simple Terms
02Summary
LazyTasks versions 1.2.29 and earlier lack proper authorization checks, allowing unauthenticated attackers to read, modify, or delete tasks and project data. An attacker can access the application over the network without credentials and perform any action a legitimate user can perform. Organizations using LazyTasks should immediately restrict network access and upgrade to a patched version.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete all tasks and projects without logging in.
Potential impact on your site
04Site Impact
All task and project data can be accessed, altered, or destroyed by anyone on the network.
Conditions required to exploit
05Prerequisites
Network access to the LazyTasks application; no authentication required.
Key dates
06Disclosure timeline
December 12, 2025
CVE published
April 8, 2026
Record updated
