Lottiefiles Vulnerabilities

[en] Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.

Affected:

up to 3.0.0

Fix:

No patched version reported

Disclosed:

Feb 20, 2026

CVE-2025-68043 on NVD →

The LottieFiles plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

9.8

Affected:

up to 3.0.0

Fixed in:

3.1.0

Disclosed:

Feb 5, 2026

CVE-2025-68043 on NVD →

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com a...

CVSS:

5.3

Affected:

up to 3.0.0

Fixed in:

3.1.0

Disclosed:

Jan 13, 2026

CVE-2026-0717 on NVD →