# CVE-2025-68043: LottieFiles - Missing Authorization

> Live exploitation tracking for CVE-2025-68043 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-68043

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.3
- **Public exploit available:** Yes
- **Affected products:** LottieFiles
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** wordpress, web_application

## Description

Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.

## CrowdSec analysis

[CVE-2025-68043](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-68043) is a missing authorization vulnerability in LottieFiles versions up to and including 3.0.0, resulting from improperly configured access control security levels. This flaw could allow attackers to exploit insufficient authorization checks, potentially granting unauthorized access to sensitive data or enabling unauthorized actions within the application.

CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-68043 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit missing authorization by sending unauthenticated requests to the `/wp-json/lottiefiles/v1/settings/` endpoint, allowing access to sensitive plugin settings and potential exposure of tokens or API keys.

## Timeline

- 2026-02-20: CVE Published. CVE-2025-68043 is published to NVD.
- 2026-04-01: Rule Released. CrowdSec releases a rule to detect CVE-2025-68043 exploitation attempts against the CrowdSec Network.
- 2026-04-09: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-68043 for the first time.

## References

- https://patchstack.com/database/Wordpress/Plugin/lottiefiles/vulnerability/wordpress-lottiefiles-plugin-3-0-0-broken-access-control-vulnerability?_s_id=cve
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68043.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-68043) follows observed exploitation activity for CVE-2025-68043. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.