The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart WordPress plugin up to version 1.2.29 suffers from a missing authorization vulnerability (CWE-862) in its REST API endpoint for editing user roles. The endpoint does not verify the identity of the requester before permitting changes to user email addresses and roles. This allows unauthenticated attackers to modify administrator email addresses, reset passwords, and gain unauthorized access to accounts, as well as assign elevated roles to users within the plugin. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation leads to full account takeover of any user, including administrators, by changing their email addresses and resetting passwords. This grants attackers administrative control over the WordPress site via the plugin, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability allows privilege escalation and unauthorized role assignment within the plugin, significantly increasing the attacker's capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST API endpoint if possible, for example by implementing firewall rules or disabling the plugin. Monitor for updates from the vendor lazycoders and apply any official patches promptly once released.