Introduction
On WordPress sites running specific versions of the LC Wizard (Connector Wizard) plugin with PRO features enabled, attackers can gain full administrative control by sending unauthenticated HTTP requests. Affected sites are open to immediate takeover and persistent compromise. The risk is highest for organizations that rely on WordPress as a business platform.
LC Wizard (now Connector Wizard) is a WordPress plugin that connects WordPress to the HighLevel/LeadConnector CRM. It is less widely known than core WordPress components, but it fills a niche that matters to agencies and businesses with CRM-driven workflows. The plugin is distributed through the official WordPress.org repository and has a history of recurring security issues. Its vulnerabilities are particularly relevant to security teams that manage CRM-integrated WordPress deployments.
Technical Information
CVE-2025-5483 is a privilege escalation vulnerability classified under CWE-862 (Missing Authorization). The root cause is a missing capability check in the ghl-wizard/inc/wp_user.php file. When the plugin's PRO functionality is enabled, it exposes an endpoint that creates user accounts without checking the requester's permissions. Unauthenticated attackers can send crafted HTTP requests to this endpoint with parameters that create new WordPress administrator accounts.
No authentication or prior access is required. Attack complexity is low, and anyone with network access to the target site can exploit the flaw with basic HTTP tools. Public advisories confirm the vulnerability, but no public code snippet of the affected logic is available. The flaw appears only when PRO features are enabled, so exposure depends on configuration.
Affected Systems and Versions
- Product: LC Wizard (Connector Wizard) WordPress plugin
- Vulnerable versions: 1.2.10 through 1.3.0
- Required configuration: PRO functionality enabled (the vulnerability is not present otherwise)
Vendor Security History
The LC Wizard/Connector Wizard plugin has a documented history of security vulnerabilities:
- CVE-2025-58237: Stored Cross-Site Scripting in versions through 1.4.1 (requires contributor access)
- Multiple input validation and authorization issues in recent versions
- The vendor has released security updates for previous vulnerabilities, but the recurring issues suggest ongoing problems with secure development practices
