Description
LottieFiles 是一个用于 WordPress 的动画插件，允许用户轻松添加和管理 Lottie 动画。该插件在 3.0.0 及之前的版本中，/wp-json/lottiefiles/v1/settings/ 端点未正确实现权限验证，导致未经身份验证的攻击者可以直接访问该端点获取包括管理员令牌、用户ID、邮箱等敏感信息。攻击者可利用这些信息进一步接管管理员账户。
WordPress LottieFiles /wp-json/lottiefiles/v1/settings/ 权限绕过漏洞（CVE-2025-68043）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cve.org/CVERecord?id=CVE-2025-68043
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68043.yaml
https://www.rapid7.com/db/vulnerabilities/lottiefiles-plugin-cve-2025-68043/
https://patchstack.com/database/Wordpress/Plugin/lottiefiles/vulnerability/wordpress-lottiefiles-plugin-3-0-0-broken-access-control-vulnerability
https://vuldb.com/vuln/345117
https://wpscan.com/vulnerability/c36b7701-2ab5-430f-8a9f-9bcc9216d894/
https://app.opencve.io/cve/CVE-2025-68043
https://www.sentinelone.com/vulnerability-database/cve-2025-68043/
https://atomicedge.io/cve-proof/cve-2025-68043-lottiefiles-version-3-0-0-critical-vulnerability-proof-of-concept/